Are online PDF tools safe? What happens to your file
Payslips, bank statements, IDs, contracts and medical records all end up as PDFs, and the quickest way to merge, compress or convert one is an online tool. Whether that is safe depends almost entirely on one question: does the file leave your device? The answer differs between tools, and between features of the same tool.
Two ways an online tool can work
Many online PDF services upload your file to their servers, process it there and send back the result. That can be done responsibly — encrypted transfer, deletion after an hour — but your document still exists, for a while, on a computer you do not control, under that company's policies and in its jurisdiction.
Other tools run entirely in your browser: the web page includes the program, and your file is read and changed on your own device without being sent anywhere. The result is the same kind of download, but there is no copy on someone else's server to be kept, leaked or misused.
How to check for yourself
Read the privacy policy for plain statements about uploads, storage and deletion, and be wary of vague wording such as "we may process your files to improve our services".
You can also watch what the page sends. On a computer, open your browser's developer tools, choose the Network tab, then run the tool. An in-browser tool shows no request carrying your file; an uploading tool shows one about the size of your document. It takes a minute and replaces trust with evidence.
The same site can do both
Features that need a large model or a server — AI summaries and chat are the common case — usually send something off your device even on a site whose other tools do not. On this site, for example, the PDF tools run in your browser, while the AI Summarizer sends the text extracted from your PDF to a server so an AI model can read it; the page says so before you use it.
Look for that kind of notice, and treat any AI feature as sending your content somewhere unless it clearly says otherwise.
Habits that protect you with any tool
Before you process a sensitive document anywhere, remove what the task does not need: split out the pages you are working on, and redact account numbers or IDs that are not relevant. Avoid tools that require an account just to compress a file, and be careful with browser extensions that ask to "read and change all your data on all websites".
Finally, clean up: delete downloaded copies you no longer need, and remember that your browser's downloads folder is often the least protected place your documents end up.