Why Online Tools Shouldn't Upload Your Files

Search for “merge PDF” and you’ll find dozens of free tools. Almost all of them work the same way: you pick a file, your browser uploads it to a server somewhere, the server does the work, and you download the result. It feels instant and it’s usually free. The question worth asking is what happened to your document in between.

What the terms of service usually say

Most reputable file-conversion services delete uploads on a timer — commonly one hour, sometimes 24. That’s better than nothing, and for a holiday photo it’s fine. But read a few privacy policies and some patterns emerge:

• “We may retain files as necessary to provide the service” — an open-ended clause that can cover backups, caching and error logs.
• Sub-processors. The file often passes through a cloud provider, a CDN and sometimes a third-party conversion API. Each has its own retention.
• Jurisdiction. Your document may be processed in a country with different disclosure rules than your own.
• Breach exposure. A file that exists on a server for one hour still exists during a breach in that hour. Deleted-on-a-timer is not the same as never-stored.

None of that is malicious. It’s simply the cost of a design that sends your data somewhere else.

When it actually matters

For most files, it doesn’t. For a specific and common set, it does:

• Legal and financial documents — leases, contracts, tax returns, bank statements, pay stubs.
• Medical records — test results, insurance forms, anything a clinic emailed you.
• Identity documents — a scanned passport or driving licence is the single most valuable file on your computer to a fraudster.
• Unreleased work — designs, manuscripts, financials, anything under NDA. Uploading a client’s file to a random website may breach the agreement you signed.
• Employer data — many organisations’ policies prohibit uploading internal documents to unapproved third-party services, and people breach that rule constantly without realising.

The awkward truth is that the tasks people most often need a quick tool for — merging a signed contract, converting an ID photo, redacting a bank statement — are exactly the files that shouldn’t be uploaded.

The alternative: do the work in the browser

Browsers stopped being simple document viewers a long time ago. Modern JavaScript engines and WebAssembly can do things that used to require a server:

• pdf-lib creates and edits PDFs — merge, split, rotate, reorder — entirely in a tab.
• pdf.js, the engine Firefox uses to display PDFs, renders pages to images.
• The Canvas API decodes, resizes and re-encodes JPG, PNG and WebP.
• WebAssembly ports of C libraries (libheif for HEIC, ffmpeg for media) handle formats browsers can’t read natively.
• The Web Crypto API generates cryptographically secure random values and computes hashes.

A tool built this way loads its code once, then works entirely on your machine. Nothing is transmitted because there’s nothing to transmit to.

How to tell whether a tool uploads

You don’t have to take anyone’s word for it, including ours:

1. Load the page, then disconnect from the internet (turn off Wi-Fi). If the tool still works, the processing is local. If it hangs or errors, it was sending your file somewhere.
2. Open developer tools (F12) → Network tab, then run the tool. Watch for a large outgoing POST request; a browser-side tool sends nothing while processing.
3. Look at the speed. A 50 MB file that processes in under a second wasn’t uploaded twice over a home connection.
4. Check for size limits. “Max 5 MB, 3 files per hour, upgrade for more” is the signature of server-side processing being paid for by someone.

What browser-side tools can’t do

Being honest about the trade-offs:

• Very heavy jobs. Video transcoding works in WebAssembly but is slow; long 4K video is still a job for a real machine.
• Anything needing a secret. Verifying a JWT signature or calling a paid API requires a key, which can’t live safely in a browser.
• Optimal compression. Server tools can run Ghostscript or MozJPEG; browser encoders are good but not always the smallest possible output.
• Old browsers. Anything more than a few years out of date may lack the APIs.
• Very large files are limited by available memory, since everything happens in RAM.

For the everyday cases — merging a few PDFs, shrinking photos for an upload form, converting an iPhone image — none of these limits bite.

The short version

If a tool doesn’t need your file to leave your computer, it shouldn’t. Every Utilgrove tool works this way: the PDF tools, the image tools and every calculator process your data locally, with no upload, no account and no file-size limit. You can verify it in ten seconds with the airplane-mode test above — and you should, on any site you trust with a document that matters.