Published 22 August 2026 · 7 min read
The honest answer is: usually, and it depends entirely on the document. That is less satisfying than a yes or a no, but "is it safe" is the wrong shape of question. What you actually want to know is what happens to this particular file, and whether that is acceptable for this particular file.
Your document is transmitted over the network to the service's servers. It is written into memory, and usually onto disk, because processing a large PDF from a stream is harder than processing it from a file. Software you cannot inspect operates on it. A result is generated and sent back. Then, according to the service's policy, the original and the result are deleted.
The major services publish these policies plainly. Smallpdf and PDF24 both state that processed files are removed within about an hour; iLovePDF states two hours. E-signature flows are the exception — signed documents and audit trails are retained far longer, sometimes for years, because legal validity requires it.
A deletion policy is a commitment about ordinary operation. It is a real commitment and these companies generally honour it. What it cannot cover is everything that is not ordinary operation:
None of this means these tools are dangerous. It means the risk is small but non-zero and, crucially, outside your control — which matters differently depending on what is in the file.
Rather than a blanket rule, ask what would happen if this exact document appeared somewhere public. For most files the answer is "nothing much", and uploading is completely reasonable. Be more careful when the document contains:
That last category is the one people most often miss. Uploading a spreadsheet of customer records to convert it is a decision made on behalf of everyone in it.
For most everyday tasks the upload is not technically necessary. Browsers can now run compiled PDF engines through WebAssembly, so merging, splitting, compressing, converting, redacting and signing can happen on your own device with the network uninvolved.
When processing is local there is no retention policy to evaluate, because there is no copy to retain. That is a structural difference rather than a stronger promise — and unlike a promise, you can verify it in about a minute using your browser's Network tab.
FilePilot works this way. If you want the comparison stated plainly, including where the server-based services are genuinely better, see the Smallpdf and iLovePDF write-ups.
Free Online PDF Tools — runs in your browser, nothing is uploaded.
For ordinary documents, generally yes. The major services publish deletion policies and honour them. The residual risk is that a copy of your file exists on infrastructure you do not control for a period, which matters more for identity documents, financial and medical records, and anything under a confidentiality obligation.
It varies and it changes, so check the current policy rather than trusting a number from an article. As of writing, Smallpdf and PDF24 state around an hour and iLovePDF states two. E-signature workflows retain signed documents and audit trails for much longer for legal reasons.
For most tasks, yes. Browser-based tools compile the PDF engine to WebAssembly and run it on your device, so nothing is transmitted. Heavy OCR, very large files and faithful Office conversion still work better on a server.
Not illegal in itself, but it can breach a confidentiality agreement or an employer policy, which is a real risk to you personally. If the document is not yours to share, process it locally instead.