Every online PDF tool now says the same thing: your files are private, nothing is stored, we respect your data. It is on every landing page, ours included. And here is the uncomfortable truth: as a reader, you cannot tell the difference between a site that means it and a site that says it. The words are identical. The file still uploads either way.
So we stopped asking you to take our word for it, and built something that measures the claim in front of you.
The claim everyone makes
"Private," "secure," "your files never leave your device," "no one can see your documents." These are promises about what happens after you hand over your file. You have no way to check them. A privacy policy can be worded carefully, changed later, or simply not match what the code actually does. Trust is the only tool you are given.
The problem is that trust is exactly the wrong thing to spend on a bank statement or a signed contract.
What we built instead: a live counter
At the top of the page, and inside every tool, there is a small pill that reads 0 B uploaded. It is not a badge or a graphic. It is a live measurement.
When the page loads, it wraps the three ways a browser can send data out:
fetch, XMLHttpRequest, and navigator.sendBeacon. Every time anything tries
to send a request body, the counter measures its size and adds it to a running
total, unless the destination is a known analytics endpoint (more on that
below). Then it renders that total, live.
Because every PDF operation runs on your device, using WebAssembly and Web Workers with no upload endpoint to send anything to, that total stays at 0 B while you merge, compress, sign, convert, or do anything else. You can watch it as you work. If a single byte of your file were ever sent somewhere it should not be, the pill would stop saying zero and turn into a warning. It is designed to catch us, not to flatter us.
How to check it yourself
You do not have to trust the counter either. Two ways to verify:
- Open your browser devtools, Network tab, and use a tool. Merge a few PDFs. You will see the app fetch its own code and, if you have not blocked them, small analytics pings. You will not see your file go anywhere, because there is no request that carries it.
- Go offline and keep working. Load the site once, then turn off your internet connection. The tools keep running. Software that uploaded your file could not do that; there would be nothing on the other end.
The counter is just a convenience. The proof underneath it is the architecture: there is no server that receives your document.
Why analytics are not counted (and why that is honest)
The counter excludes requests to analytics hosts, and it is worth being upfront about that. We use privacy-friendly, cookieless analytics that record page views and performance, never the contents of your files. Those pings carry no document data, so counting them would be misleading in the other direction: it would flip the pill to "bytes sent" for something that has nothing to do with your PDF.
The same allowlist that the counter uses is also enforced by an automated test that runs on every release. That test loads the tools, exercises them with real files, and fails the build if any request to any host ever carries file bytes. So the promise is checked by machine before a single line of code ships, not just asserted in a blog post.
The receipt you can keep
When a tool finishes, the result screen prints a small privacy receipt: the file name, its size, that it was built on your device, and the measured 0 B uploaded. You can copy it, or screenshot it, and keep it. It is a record of a specific fact about a specific operation: this file was processed, and nothing left your machine.
Try to break it
Open any tool, drop in a file, and watch the counter. Then open devtools and look for the upload that is not there. Start with Merge PDF, Compress PDF, or Remove Signature for a document you would never upload anywhere. If you find a way to make the counter move with a real file, we want to hear about it: that is the most useful bug report we could get.
Everyone can promise privacy. We would rather show you the number.