Is it safe to upload documents to an online converter?

What actually happens when you upload a file

The word "upload" hides a sequence of events worth spelling out. Your browser opens a connection to a server, sends the entire contents of your file across it, and that server writes those bytes to disk. The file is now a real object in someone else’s infrastructure — usually in cloud object storage, frequently replicated across more than one physical location for durability, and often passing through a load balancer, a queue and a worker process on the way.

Each of those hops is a place the file exists. Reasonable operators encrypt the connection and the storage, and the good ones delete on a timer. But the honest summary is that a complete copy of your document is sitting on hardware you do not control, governed by a retention policy you are trusting rather than verifying, accessible to whichever employees and subprocessors have the necessary permissions.

For a holiday photo that is a non-event. For a signed contract, a bank statement, a passport scan, a medical letter or an unreleased document, it is a decision — and it is usually made without anyone realising a decision was being made at all, because the interface is a button that says Convert.

How long files are actually kept

Most reputable converters state a deletion window, commonly somewhere between one hour and twenty-four. That claim is almost always sincere and almost always about the primary copy. What it does not usually cover is everything else the file touched on its way through: backup snapshots taken on their own schedule, CDN or proxy caches, error logs that captured a payload when a conversion failed, and the queue the job sat in.

Deletion in distributed storage is also less immediate than the word suggests. An object marked deleted is typically unlinked rather than overwritten, and it disappears from backups when those backups roll over, which can be weeks. None of this is sinister — it is how durable storage works — but it does mean "deleted after one hour" and "gone after one hour" are different sentences.

The practical test is simple and slightly uncomfortable: you cannot check any of it. There is no way, from outside, to confirm that a file was deleted, that logs were scrubbed, or that no copy was retained. You are trusting a policy document, and a policy document can change with a version bump you will never read.

Who can read it while it is there

Three groups, in descending order of likelihood. Staff with production access, who can generally read stored objects — legitimate operators restrict this and log it, but the capability exists by construction. Subprocessors, meaning the cloud provider, the CDN and whatever monitoring stack is installed; each has its own terms and its own jurisdiction. And attackers, in the event of a breach, for whom a converter holding thousands of freshly uploaded business documents is an unusually attractive target.

That last point deserves weight. A file-conversion service is a concentrated pile of exactly the documents people consider sensitive enough to be careful with, all arriving voluntarily, all recent. Breaches of that shape have happened repeatedly across the industry.

There is a legal dimension too. Once your document is on a server in another country it is subject to that country’s disclosure regime. If you are handling personal data under the GDPR, uploading it to a processor you have not assessed is itself a compliance question — one that applies to a marketing manager compressing a spreadsheet of customer names just as much as it does to a hospital.

When uploading is genuinely fine

It is worth being proportionate rather than paranoid. If the document is already public — a brochure, a published paper, a photo you posted last week — uploading it changes nothing, because the confidentiality you would be protecting does not exist. The same goes for anything you would be comfortable emailing to a stranger.

It is also fine when the alternative is worse. A person who cannot convert a file at all may end up sending the original by email to someone who can, which is a copy on more servers, not fewer. A reputable converter with a short retention window beats a chain of five forwarded attachments.

The question to ask is not "is this service trustworthy" but "does this file need to leave my machine at all". For most everyday conversions the answer turns out to be no, because the browser can already do the work.

How to convert without uploading anything

Modern browsers ship the machinery to do this locally. They can decode and encode JPEG, PNG and WebP natively, and they run WebAssembly at close to native speed, which is enough to manipulate PDFs, resize images and rearrange pages entirely on your own device. When a tool is built that way the file is read from disk into memory, processed, and handed back — no request is made, so there is nothing to retain, leak or subpoena.

The important part is that this is checkable, which almost nothing else in this article is. Open your browser’s developer tools, switch to the network tab, and use the tool. If your file were being uploaded you would see the request: a POST carrying several megabytes. If nothing appears, nothing was sent. That takes about fifteen seconds and it does not require believing anyone.

Desktop software is the other route and remains a good one — a local application has the same property by definition. The tradeoff is installation, licensing and updates, which is precisely the friction that sends people to a website in the first place.

Every tool on this site works the local way, which is why there is no upload queue, no file-size trap and no retention policy to read: we never receive the file, so there is nothing for us to keep.

Questions