Is the offline test reliable, or can a tool fake it?

It cannot be faked in the direction that matters. A tool that needs a server cannot produce your converted file without one — the code simply is not on your machine. The failure mode runs the other way: a genuinely local tool can fail the test if you disconnect before it has finished downloading its engine, which is why you should let the page load and run it once while connected first. A tool could also do the work locally and still send a copy somewhere, which the offline test would not catch; that is what the Network tab is for, and it is why the second half of the checklist exists.

If the file never leaves my browser, where does the download come from?

From the page itself. The tool builds the result in memory and hands it to the browser as a blob, and the browser saves it exactly as it would save something fetched from a server — same dialog, same downloads folder. Nothing about the download indicates where the bytes were produced, which is precisely why the offline test is more informative than watching the file arrive.

Are upload-based services unsafe, then?

No, and it would be a poor reading of this article to conclude that. They encrypt in transit, they delete on a published schedule, and the large ones are audited to standards most small sites never reach. The distinction is that they create a window and a jurisdiction where none previously existed, and you should know that you are creating one. For most files that is a fine trade, and for a two-gigabyte video it may be the only workable one.

Does an in-browser tool still work if I close the tab halfway?

No, and that is the flip side of the guarantee. The work only exists inside the page, so closing the tab ends it and there is nothing to resume — no queue on a server holding your job. On a long video conversion, keep the tab in the foreground: some browsers throttle background tabs hard enough to slow the work to a crawl, and a phone may reclaim the memory outright.

Which files genuinely warrant this level of care?

Anything holding someone else's personal data, because there the answer is not a preference but a compliance question — client lists, applications, medical documents, school records. Then anything whose disclosure would harm you directly: payslips, bank statements, identity documents, a contract before it is signed, unpublished work. For a restaurant menu or a holiday photo the sensible answer is to use whatever is quickest. The reason to know which tool you are using is that habits formed on the menu are the ones you will apply to the contract.

Pull the Plug: Which Online File Tools Actually Upload Your Document

Published 6/23/2026 · 12 min read · File tools

Daniel Okonkwo — Front-end developer and tech writer at Allin

Web performance · File formats

Checked against 5 sources

View profile →

In short

Disconnect from the network, then use the tool. If it still works, your file never left the machine; if it fails, it was being uploaded. That is the whole test, it takes five seconds, and it cannot be defeated by marketing copy. The distinction it exposes is architectural, not a matter of degree. An upload-based tool sends your document to a server, processes it there and deletes it later: iLovePDF states on its own help page that anything uploaded "is automatically deleted in a time range of 2 hours", and Smallpdf states one hour for its free tools, with fourteen days for files handled by eSign or sharing. Those are honest, reasonable windows — but during them the file exists on someone else's disk, inside their jurisdiction, reachable by their staff and by anyone who compromises them. A browser-based tool has no such window because there is no copy. Allin's file tools are the second kind: the PDF, image, audio and video tools run entirely in the page, and the WebAssembly they need is served from this site rather than a CDN, so not even the runtime download hands a third party your address. You do not have to believe that. Turn off your Wi-Fi and compress a PDF.

Every online file tool promises your document is safe. Almost none tell you whether it leaves your machine at all. There is a five-second test that settles it without reading a single privacy policy, and it works on any tool — including this one.

"Secure" answers a question nobody asked

Look at the top of almost any online PDF tool and you will find the same three assurances: the connection is encrypted, the files are deleted, the servers are secure. Every one of those statements can be entirely true while the thing you actually wanted to know goes unanswered. Encryption in transit protects the file from someone watching the wire. It does nothing about the server at the other end, which by definition receives the file decrypted, because it has to in order to work on it.

Deletion after a fixed window is a real commitment and worth having, but it is a promise about the future, not a statement about the present. Between the upload and the deletion there is an interval during which a complete copy of your document sits on hardware you do not control. For iLovePDF that interval is up to two hours by its own account; for Smallpdf's free tools it is one hour, and fourteen days for anything routed through eSign or file sharing. Those are among the shorter windows in the industry. The point is not that they are long. The point is that the question "how long is it kept?" only exists because the answer to "is it sent at all?" was yes.

None of this makes those services untrustworthy. They are large, they are audited, and a two-hour window is a genuine engineering commitment that costs money to honour. It makes them a different shape of thing from a tool that never receives the file, and shape is what you should be choosing on when the document is a payslip, a medical result, a contract under negotiation or a client's data you are legally responsible for.

Why disconnecting is the only test that cannot be gamed

A tool that processes files on a server has no way to complete the job without the network. There is no clever fallback, no cache that helps: the code that does the work is not on your machine, so with the connection cut it cannot run. A tool that processes files in the browser has already downloaded everything it needs by the time you press the button, so it does not notice the network is gone. The test works because it asks the software to do something only one of the two architectures is physically capable of.

There is one honest complication, and it is worth knowing so the result does not mislead you. Browser-based tools are usually large — a video engine compiled to WebAssembly runs to tens of megabytes — and they fetch that engine on first use. If you disconnect before the engine has finished downloading, an entirely local tool will fail, and it will look like an upload. The fix is in the first step above: let the page settle, use the tool once while connected, and only then pull the plug. What you are testing is whether the file moves, not whether the program can materialise out of nothing.

Where the engine comes from is its own question

Passing the offline test proves your file stayed put. It does not prove that nothing at all was communicated, because many browser-based tools load their WebAssembly from a public CDN rather than from their own domain. That single request tells the CDN operator your IP address, your browser, the page you were on and therefore what you were about to do. The file is private; the fact that you converted one is not.

This site serves its own. The video and audio engine is fetched from /ffmpeg/ on this domain and the PDF rendering worker from /pdfjs/, so the only party that learns you opened a file tool is the site you deliberately opened. It is a small thing next to not uploading the document, and it is exactly the kind of small thing that gets skipped when a CDN link is one line of code and self-hosting is a build step.

What in-browser processing genuinely costs you

It would be dishonest to present this as free. Work done in your browser runs on your processor, in your memory, and it is bounded by both. A server farm can throw thirty-two cores at a two-gigabyte video; your laptop cannot, and on a phone the tab may simply be killed by the operating system for using too much memory. For very large media files, an upload-based service will genuinely be faster, and sometimes it will be the only thing that finishes at all.

The trade is also uneven by file type, and the honest version is worth stating. PDF structural work, image resizing and compression, subtitle and text handling, and most audio operations are comfortable in a browser on ordinary hardware. Long video transcoding is where the ceiling gets low fast. If the file is small enough that the local tool finishes, there is no reason to send it anywhere; if it is not, that is a real reason to choose otherwise, and it is a better reason than a marketing badge.

When it stops being a preference and becomes an obligation

For a holiday photo, none of this matters. For documents handled in the course of work, it can stop being a matter of taste. Under the GDPR, sending a file containing someone else's personal data to an online service makes that service a processor acting on your behalf, and the arrangement needs a contract with specific content under Article 28 — not a checkbox, an actual agreement. Uploading a client list, a set of applications or a batch of medical forms to a free web tool is, in the strict sense, a transfer you are responsible for and probably have not papered.

The attraction of a tool that never receives the file is that the question dissolves rather than being answered. There is no processor because there is no processing on anyone else's behalf, no transfer to document, no retention period to reconcile with your own, no breach notification to think about for that path. Whether that matters to you depends entirely on what is in the document — which is why the test in this article is worth running once on whatever you already use, before the day it turns out to matter.

A checklist you can apply in a minute

Run the offline test first, because it answers the only question that has a hard yes or no. If the tool survives it, check where the engine came from: open the Network tab on a fresh load and look at the domains, not the file names. If everything comes from the site's own domain, nothing outside it learned you were there. If the tool fails the offline test, you are on the upload side, and the useful follow-up questions are the ones the service should answer in writing: how long is it kept, in which country, and is there a way to delete it immediately rather than waiting out the window.

One last habit worth adopting whatever you choose: judge the tool by what it does with the boring files, not the sensitive ones. Nobody decides carefully in the moment they are about to send a contract. They use whatever they used last time.

Two architectures, and what each one implies — retention figures are each service's own published statement, read on 12 August 2026
Question	Upload-based service	In-browser tool
Does the file leave your machine?	Yes — that is how it works	No
How long is a copy kept?	iLovePDF: up to 2 hours. Smallpdf: 1 hour on free tools, 14 days via eSign or sharing	There is no copy to keep
Works with the network off?	No	Yes, once the engine has loaded
Limit on file size	Set by the service, often raised on a paid plan	Your device's memory — lower on a phone
Speed on a large video	Faster — server hardware, many cores	Slower, and may not finish at all on a phone
GDPR: is it a processor you must contract with?	Yes, if the file holds other people's personal data (Art. 28)	No transfer takes place, so the question does not arise

Compress PDFShrink a PDF without losing anything: identical fonts and images repeated by a merge are merged back into one. A whole folder at once.Try the tool →

Frequently asked questions

Is the offline test reliable, or can a tool fake it?: It cannot be faked in the direction that matters. A tool that needs a server cannot produce your converted file without one — the code simply is not on your machine. The failure mode runs the other way: a genuinely local tool can fail the test if you disconnect before it has finished downloading its engine, which is why you should let the page load and run it once while connected first. A tool could also do the work locally and still send a copy somewhere, which the offline test would not catch; that is what the Network tab is for, and it is why the second half of the checklist exists.
If the file never leaves my browser, where does the download come from?: From the page itself. The tool builds the result in memory and hands it to the browser as a blob, and the browser saves it exactly as it would save something fetched from a server — same dialog, same downloads folder. Nothing about the download indicates where the bytes were produced, which is precisely why the offline test is more informative than watching the file arrive.
Are upload-based services unsafe, then?: No, and it would be a poor reading of this article to conclude that. They encrypt in transit, they delete on a published schedule, and the large ones are audited to standards most small sites never reach. The distinction is that they create a window and a jurisdiction where none previously existed, and you should know that you are creating one. For most files that is a fine trade, and for a two-gigabyte video it may be the only workable one.
Does an in-browser tool still work if I close the tab halfway?: No, and that is the flip side of the guarantee. The work only exists inside the page, so closing the tab ends it and there is nothing to resume — no queue on a server holding your job. On a long video conversion, keep the tab in the foreground: some browsers throttle background tabs hard enough to slow the work to a crawl, and a phone may reclaim the memory outright.
Which files genuinely warrant this level of care?: Anything holding someone else's personal data, because there the answer is not a preference but a compliance question — client lists, applications, medical documents, school records. Then anything whose disclosure would harm you directly: payslips, bank statements, identity documents, a contract before it is signed, unpublished work. For a restaurant menu or a holiday photo the sensible answer is to use whatever is quickest. The reason to know which tool you are using is that habits formed on the menu are the ones you will apply to the contract.

Articles you may find interesting

All guides →

How-toPhotographing a Document and Getting a PDF That Is AcceptedNobody owns a scanner any more, so the phone does it. Two things decide whether the result is accepted: how you took the photograph, and what page size it becomes. The second one surprises people, because a photograph turned into a PDF is not A4 unless something makes it A4.How-toGetting a PDF Under a 10 MB Upload LimitThe form rejects your file and offers no advice. What works depends entirely on where the megabytes actually are, and for a scanned document the answer is not compression at all — it is resolution. Here is how to tell which case you have in ten seconds.How-toPutting a Scanned Document Back in the Order It Was PrintedA duplex scanner that took one side at a time, a stack fed upside down, a page that came out twice. Reordering is not the same operation as extracting pages, and knowing which one you are doing tells you what happens to everything that is not a page.ExplainerWhy Compressing a File Twice Does Not Halve It TwiceThe first pass takes 30% off and the second takes nothing. That is not a broken tool — it is the difference between removing redundancy and removing information, and knowing which one you are doing tells you when to stop and what a second attempt actually costs.GuideWhat a PDF Says About You: Reading and Clearing Its MetadataA PDF carries its metadata twice, in two stores that can tell different stories, and neither of them is the whole story. Here is what is actually in the file, what clearing it removes, and the two things that survive every wipe.How-toTurning Notes into a PDF Worth ArchivingPlain text has no layout, so any converter has to invent one for you. Here is exactly which decisions this one makes — page, margins, font, line breaks — what it does with a tab and a long line, and what you have to add yourself before a note is worth keeping.

Retention windows and processing models are what each service published on the dates cited. They change without notice — re-run the offline test on any tool you rely on rather than trusting a comparison, including this one.

Sources

Spotted a mistake in this article?