Do not trust us. Verify us.
Every PDF site says your files are safe. Ours is the claim you can check yourself, in about a minute, with tools already built into your browser.
The one-minute test
- 1
Open the network panel
Press F12 (Windows) or Cmd+Option+I (Mac) and choose the Network tab. In Firefox it is under Web Developer Tools; in Safari, enable the Develop menu first in Settings, then choose Show Web Inspector.
- 2
Run a tool on a real file
Open Merge PDF, drop in two files, and click Merge. Keep the network panel visible while it works.
- 3
Read the evidence
No request appears carrying your file. No POST with megabytes of payload, no upload progress, nothing. The merge happened inside your browser, and the result downloads from your own device memory.
Being honest about what you will see: the first load fetches the app itself, and after your first interaction two analytics loads appear, Google Analytics (cookieless unless you opt in via the consent banner) and a Cloudflare Web Analytics beacon (cookieless page metrics). Those requests are kilobytes of site plumbing and never contain your document, its name or its size. If you prefer, block both analytics hosts in your ad blocker or proxy: every tool keeps working.
The stronger test: pull the plug
Load the site once, then turn on airplane mode or switch off Wi-Fi, and use the tools anyway. Merging, splitting, compressing all keep working, because after the first visit the app is cached on your device. A tool that uploads cannot do this: no connection, no processing. One honest caveat: a few heavyweight tools (OCR, scan cleanup, repair) fetch their large engine the first time you run them, so use those once while online if you want them offline later.
How it is enforced, in plain language
No upload endpoint exists
This site is static files served from a CDN. There is no application server listening for your documents, so there is nowhere to send them even by mistake.
The engine runs in your tab
The PDF engines run in your browser, pdf-lib and pdf.js as JavaScript, qpdf and Tesseract as WebAssembly, inside background workers. Your file is bytes in your tab's memory from start to finish.
The browser stands guard
A Content-Security-Policy header makes your browser refuse connections to anything beyond this site and a short, printed list of analytics hosts, which you can block independently. It narrows where anything could go, and whatever remains is visible in the network panel you already know how to open.
The policy itself, verbatim
This is the exact Content-Security-Policy our CDN attaches to every page. Compare it with the response headers in your own browser; they should match, character for character. It is attached at the CDN layer, not by the page, so a compromised deploy could not quietly widen it. (One worker asset path, /cv/, carries a documented variant for the OpenCV engine; its connect-src allows no external host at all.)
default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://www.googletagmanager.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.google-analytics.com https://*.google-analytics.com; font-src 'self'; connect-src 'self' blob: https://www.google-analytics.com https://*.google-analytics.com https://*.analytics.google.com https://www.googletagmanager.com https://cloudflareinsights.com https://static.cloudflareinsights.com; worker-src 'self' blob:; child-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests- connect-src is the one that matters: the only destinations the browser will let this site contact are itself and the Google and Cloudflare analytics hosts above. No document storage, no third-party APIs.
- worker-src / wasm-unsafe-eval exist so the PDF engines can run locally in workers, which is the whole point.
- frame-ancestors 'none' stops other sites loading these tools in a hidden frame (clickjacking).
Want the engineering detail? Read how we built PDF tools that cannot see your files. Evaluating this for a company or team? See PDFMergely for your organization.
Frequently asked questions
Is PDFMergely safe for confidential files?+
It is designed so you do not have to take that on faith. Files are processed in your browser and never uploaded, which you can verify yourself: watch the network panel while a tool runs, or go offline and use the tools anyway. For contracts, statements and IDs, that verifiability is the point.
Why do I see any network requests at all?+
First, the app itself: the page, scripts, styles and fonts. Then two small analytics loads, enumerated honestly in the test section above: Google Analytics (cookieless unless you opt in) and a Cloudflare beacon (cookieless page metrics, not consent-gated). None of them carry your document, its name or its size, and you can block both analytics hosts outright with no loss of functionality.
Does working offline really prove anything?+
Yes, and it is the strongest test. With the connection off there is physically no way to transmit your file anywhere. An upload-based tool stops working the moment you disconnect; these tools keep working, which is only possible because the processing happens on your device.
Can you see my file names or contents?+
No. Files are opened in your browser tab and never transmitted, so we cannot see contents, names or sizes. Page analytics record which page was visited, never anything about your files, and you can block the analytics hosts entirely if you prefer.
What stops a bug or a hack from uploading my file?+
Layers, and none of them are promises. There is no upload endpoint to receive files. The Content-Security-Policy tells your browser to refuse connections to anything beyond this site and a short, printed list of analytics hosts, which you can block independently. And bulk exfiltration would have to appear in the same network panel this page just taught you to watch.
How is this different from a privacy policy promise?+
A policy describes intent; this is architecture. The site is static files on a CDN, and the PDF engines run inside your tab. You do not have to trust the claim, because you can watch it be true, on any visit, in about a minute.