Are Online PDF and Image Converters Safe? A 2026 Privacy Audit

"It's just a quick PDF merge, what's the harm?" In 2026, quite a bit — depending on which converter you picked. We spent a week auditing the most popular online PDF and image converters to answer one question: what actually happens to your file after you hit Upload?

The five questions we asked of every service

1. Is the file uploaded to a server, or processed locally?
2. How long is the file stored, according to their policy?
3. Are IP addresses, filenames, and metadata logged?
4. Are files shared with third parties (ad networks, analytics)?
5. Can you verify any of the above independently?

We didn't ask "are they trustworthy?" — that's a judgment call. We asked "what is the file exposed to, regardless of intent?"

The pattern we saw

Most large online converters follow a similar architecture. You upload the file, it lands in cloud object storage (S3, GCS), a worker picks it up, converts it, and writes the result back. Both the input and the output live in storage for a retention window — anywhere from one hour to 30 days. Filenames, sizes, IPs, and user agents are logged for abuse prevention and analytics.

None of this is unusual. It's how web services work. But it means:

• The operator can read your file. Not because they want to — because that's what "server-side processing" means.
• A breach exposes your file. Any leak of the storage bucket includes everything uploaded during the retention window.
• Subpoenas apply. A US-hosted converter can be compelled to hand over stored files. Retention policies determine what's still there when the request arrives.
• Third-party trackers run on the same page. Most free converters embed Google Analytics, ad networks, and session replay tools. None of them see the file contents, but they see the filename in the URL and the pattern of your visits.

What the fine print actually says

We read the privacy policies of the ten most-searched PDF and image converters. A few recurring phrases:

• "We may retain your files for up to X days to improve service quality." Translation: files aren't deleted immediately, and may be sampled by staff.
• "We do not share your files with third parties." This rarely covers subprocessors — the cloud provider hosting the storage, the CDN serving the download, or the analytics vendor reading your session.
• "Files are processed on secure servers." "Secure" is undefined. HTTPS in transit is table stakes; what matters is what happens after decryption.
• "By uploading, you grant us a license to process the file." Boilerplate, but a reminder: you are transferring a copy under a license agreement.

None of this is nefarious. All of it is the cost of the architecture.

The categories of file that shouldn't go through a cloud converter

If a file falls in any of these buckets, don't upload it:

• Signed contracts, NDAs, term sheets
• Medical records, prescriptions, insurance claims
• Passports, driver's licenses, birth certificates
• Tax returns, bank statements, brokerage reports
• Client work under a confidentiality agreement
• Internal company documents that aren't public
• Anything with a minor's personal information

For everything on that list, the correct answer in 2026 is a browser-based tool.

How to verify a tool actually processes locally

Don't take anyone's word for it, including ours. Verify:

1. Open the tool's page in a fresh browser tab.
2. Open DevTools → Network. Enable "Preserve log."
3. Run the tool on a small dummy file.
4. Inspect every request. If nothing outbound carries your file's bytes — no POST with the file body, no multipart upload — the tool is genuinely local.
5. For bonus points: turn Wi-Fi off after the page loads and try the conversion. A browser tool will still work. A cloud tool will hang.

Every Zro7 tool passes this test. It's designed to. Try Compress PDF and see for yourself.

The one-line summary

Cloud converters are convenient and — for public files — perfectly fine. But once the file matters, "the server never sees it" is the only privacy guarantee that actually holds. That's the guarantee a browser-only tool gives you by construction. It's why we built Zro7.