Are online PDF tools safe? What happens to your files

By the LambiPdf team · Updated 3 November 2026 · 7 min read

Free PDF websites are convenient: drop a file, click a button, download the result. But the PDFs people edit are often passports, payslips, contracts and medical letters. Before you drop one into a website, it is worth knowing where it goes. This guide explains the two ways online PDF tools work and how to tell which one you are using.

Two kinds of online PDF tool

Server-based tools

Server-based PDF services upload your file to their servers, process it there and send back the result. That design is easy to build and can handle heavy work quickly. It also means a copy of your document sits, at least briefly, on computers you don’t control. Reputable services publish how long they keep files and delete them after a period, but you are relying on their policy, their security and that of any providers they use.

In-browser tools

A newer approach runs the processing inside your web browser. The website sends your browser the program code, and your own computer or phone does the work. The document is read from your disk into the page’s memory, processed there and saved back to your device. It doesn’t need to travel anywhere. LambiPdf is built this way.

How to check where your file goes

You don’t need to take any website’s word for it. Every modern browser can show you its network traffic:

1. Open the tool’s page, then open developer tools: press F12, or Cmd+Option+I on a Mac, and choose the Network tab.
2. Clear the list, then add your PDF and run the operation.
3. Watch for new requests while it works. Inspect request destinations, methods and payloads while running the operation. Uploads can be compressed, split into small requests or sent later, so request size alone is not a dependable test.

A second test: once the page has fully loaded, disconnect from the internet and try the tool. An operation requiring a server connection cannot finish without that connection. In-browser tools generally keep working, although some features may need to download extra components, such as OCR language data, the first time they are used.

Questions to ask before uploading a sensitive file

• Does the service say clearly whether files are uploaded, and for how long they are kept?
• Who operates it, and is there a real privacy policy and a way to contact them?
• Does it need an account or an email address for a simple task? That is more data about you.
• Does your employer or school have rules about which tools may handle their documents?

What “private” does and doesn’t cover

Local document processing avoids a document-processing upload, but the label “in-browser” alone does not establish how every script behaves. It doesn’t protect against everything. Browser extensions can read pages you visit, a shared or compromised computer can expose files on its disk, and downloaded results end up wherever your downloads folder syncs to. Websites may still load ads or analytics on their informational pages. LambiPdf keeps them off the page where you open documents; its privacy policy explains what runs where.

The short version

For a recipe card or a public form, it hardly matters which tool you use. For an ID, a bank statement or a signed contract, prefer a tool that processes the file on your device, and take two minutes to verify that claim with the Network tab.

Questions people ask