How to verify an online PDF tool is private

Every PDF site says it cares about your privacy. Some upload your document to their servers anyway. That's how most of them work, and the privacy policy saying "files are deleted after one hour" is the admission. You don't have to trust anyone's copy, though. Whether a website uploads your file is observable, on your own machine, in about two minutes.

The check

1. Open the tool's page, then open your browser's developer tools: press F12 (or Ctrl+Shift+I, Cmd+Option+I on a Mac) and click the Network tab.
2. Clear the list (the 🚫 icon) so page-load noise doesn't distract, and leave the tab open.
3. Use the tool. Drop in a PDF (a throwaway one, if you're testing an untrusted site) and run the operation.
4. Read the list. Watch for requests that appear when you drop the file or when you press the action button. Click any request and check its size and method: an upload is a POST or PUT request whose payload is roughly the size of your file.

How to read what you see

• A multi-megabyte POST right after you add the file is your document leaving. The processing happens on their server, whatever the homepage says.
• Downloads of scripts or .wasm files are fine. That's the tool fetching its own code (a PDF engine) to run locally. Downloaded code is normal; an upload of your file is not.
• Small analytics pings are page-view counting, not your file. Size gives it away. Your 4 MB document cannot hide inside a 300-byte request.
• Nothing at all is the strongest result you can get. The file goes in, the result comes out, and nothing appears in the request list. The work provably happened on your machine.

Reading a privacy policy the same way

You can often tell how a tool works before touching the network tab, because the privacy policy has to describe the machinery. The phrases to look for:

• "Files are deleted after N hours" means files are uploaded. A deletion schedule only exists for servers that receive your documents.
• "Encrypted in transit" means there is transit. HTTPS protects the file on its way to their server; it says nothing about what happens once it arrives.
• "Processed in your browser" / "never leaves your device" is the claim you can actually verify, with the check above, in about two minutes.

Stronger proof: pull the network cable

The check above is convincing; this one settles it. Run the tool once with a throwaway file, so it finishes downloading its own code; in-browser tools typically fetch their processing engine on the first use, not with the page. Then turn off Wi-Fi (or switch to airplane mode) and run it again. If the tool still processes your file and produces a result with no connection at all, an upload is impossible. Upload-based tools fail this test immediately.

Why this matters more for some documents

For a lunch menu, none of this matters. For contracts, medical records, IDs, visa paperwork, unpublished manuscripts, and privileged legal material, "trust us, we delete it" is not something you can verify. The file existing on someone else's server, however briefly, may itself violate a confidentiality obligation. For those documents, use tools where the upload provably never happens.

What the check can't tell you

The check has limits. It proves what a site did on the day you ran it, not what it will do after the next update, so for a document that really matters, run it again. The airplane-mode version leaves nothing to interpretation. It also says nothing about the rest of your machine: browser extensions can read pages independently of the site, and monitoring software on a work laptop operates outside the browser entirely. The network tab settles one specific question, whether this website received your document, and for confidential files that is usually the deciding one.

Try it on us

This site is built to pass exactly this test, which is why every Sleek PDF tool runs in your browser. Open the network tab, compress something, and watch the request list stay empty. The full technical detail of how that works is on the privacy page.