Table of Contents
How Online PDF Editors Handle Your Files
Server-Based Processing (The Majority)
iLovePDF, Smallpdf, Sejda, PDF24, Adobe Web, PDF Candy, Canva, Foxit Online, Nitro Cloud, Xodo — they all work the same way:
- You upload your PDF (HTTPS encrypts in transit)
- File lands on their server (disk, memory, database)
- Their software processes it (same engines as desktop apps)
- Result sent back to your browser (HTTPS)
- File deleted per their retention policy (1 hour–30 days typical)
Your document touches their infrastructure. You're trusting their security, their policies, their jurisdiction, their employees, their subprocessors.
Client-Side Processing (Our Architecture)
onlinepdfeditors.com and a handful of others work differently:
- You open the tool — WebAssembly modules download once (cached by Service Worker)
- You select a file — it's read from your disk into browser memory (ArrayBuffer)
- Wasm module processes it in your browser sandbox — zero network calls
- Result written to your download folder — never leaves your machine
Your document never uploads. Not even metadata. The Wasm module has no network permission. You can verify: open DevTools → Network tab → process a file → zero outbound requests with PDF data.
The Risks of Uploading PDFs
Data Retention
"We delete files after 1 hour" — but what about backups? Logs? Analytics? Crash dumps? GDPR Art. 30 records? Most providers retain far longer than advertised. Some keep files indefinitely for "service improvement" (training AI on your documents).
Breaches
Server databases get hacked. In 2023–2024 alone: major PDF service breaches exposed millions of user documents. Client-side processing eliminates this attack surface — there's no server database of your files to breach.
Metadata Leaks
PDFs carry hidden data: author, company, creation software, timestamps, GPS coordinates (from phone scans), revision history, hidden layers, form field data, embedded files. Server-side tools see all of it. Some index it. Client-side: only you see it.
Legal Access
Subpoenas, warrants, national security letters, court orders — providers must comply. Your documents on their servers are accessible. Your documents on your device? Your jurisdiction, your encryption, your control.
Terms of Service Changes
"We don't sell your data" — until the company gets acquired, pivots, or updates ToS. You agreed to "future changes." Client-side: no ToS can reach your local files.
How to Know If a Tool Is Safe
Checklist — any "No" is a red flag:
- ☐ HTTPS only? (Padlock in address bar. Non-negotiable.)
- ☐ Explicit "no upload" / "client-side" claim? (Not "secure upload" — that's still upload.)
- ☐ Verifiable? Can you check DevTools → Network and see zero upload?
- ☐ Clear data policy? Retention period, subprocessors, jurisdiction stated?
- ☐ No account required? Account = identity link to your documents.
- ☐ Open about encryption? AES-256 for password protection? TLS 1.3?
- ☐ Offline capable? Service Worker caching = works without internet = proves client-side.
Client-Side Editing — How "No Upload" Actually Works
WebAssembly
Wasm lets C/C++/Rust code run in the browser at near-native speed. Our PDF engines (merge, split, compress, encrypt, rasterize) are compiled from the same C libraries desktop tools use — PDFium, custom optimizers — to Wasm. They run in your tab's sandbox.
What Stays on Your Device
- The PDF file (never leaves your RAM/disk)
- The encryption keys (for password protect/unlock)
- The processing logic (Wasm modules, cached locally)
- The result (downloaded to your chosen folder)
What Goes to Our Server
- Static assets: HTML, CSS, JS, Wasm modules (on first visit)
- Analytics: page views, tool usage counts (no file data, no IP linking)
- That's it.
Verify It Yourself
- Open onlinepdfeditors.com/compress-pdf
- Open DevTools (F12) → Network tab
- Check "Disable cache" (optional)
- Drag a 10 MB PDF in
- Click Compress
- Watch Network tab: zero requests containing PDF data. Only the initial Wasm load (cached) and maybe a favicon request.
Privacy Best Practices for Sensitive Docs
Strip Metadata
Before sharing: Compress PDF (Low level) strips XMP, thumbnails, piece info, document info. Or use a dedicated metadata stripper.
Password-Protect
Protect PDF with AES-256. Open password for confidentiality. Permissions password for control. Share password out-of-band (Signal, phone).
Avoid Public Wi-Fi
Even with HTTPS, metadata (destination, timing, volume) is visible. Use a VPN. Or better: client-side tools work offline — disable Wi-Fi, process, re-enable.
Watermark for Traceability
Watermark PDF with recipient name/email. If it leaks, you know the source.
Use a Password Manager
Store PDF passwords in Bitwarden, 1Password, KeePass. Never email passwords. Never reuse.
How Our Tool Works
Deep dive: How It Works (architecture page) and Privacy-First Compress & Optimize.
Summary: 12 tools (merge, split, rotate, remove/extract pages, compress, JPG↔PDF, protect, unlock, watermark, page numbers). All client-side. All free. All offline-capable. No account. No tracking of file data.
FAQ
Is it safe to upload PDFs to online tools?
You're trusting the provider. Server-side tools see your full document. For public flyers: fine. For contracts, taxes, medical records: use client-side tools (like ours) where files never upload.
Do online PDF editors store my files?
Most do — temporarily (1 hr–30 days). Some longer. Check their privacy policy. Our tool: never. Zero storage.
Is iLovePDF / Smallpdf / Sejda safe?
They're reputable companies with decent security. But they're server-based — your files upload. For sensitive docs, that's a risk you must accept. We're not them — we're client-side.
Can I edit a PDF without uploading it?
Yes. Client-side editors like onlinepdfeditors.com process everything in your browser. Zero upload.
Are free PDF editors safe?
"Free" often means "you're the product" (data harvesting, ads, upsells). Our tool is free because client-side costs us near-zero (no server compute, no storage). No ads. No upsells on core tools.
What is a private PDF editor?
One that processes files locally (client-side). Your documents never leave your device. onlinepdfeditors.com is a private PDF editor.
Can I use a PDF editor on public Wi-Fi safely?
With client-side tools: yes — disable Wi-Fi after loading, process offline. With server-based: no — your upload/download is visible (metadata at minimum).
Want zero-upload PDF editing? Open onlinepdfeditors.com — 12 tools, free, private, offline-capable. Your documents never leave your device.