Dev.to Security 🔐 Cybersecurity 👁 0 📖 2 min read

How to check that a PDF tool really doesn't upload your files

Plenty of PDF tools say your files stay on your device. You can check that yourself in a couple of minutes, with the browser you already have and a throwaway test file. Check 1: watch the Network tab Open th

Plenty of PDF tools say your files stay on your device. You can check that yourself in a couple of minutes, with the browser you already have and a throwaway test file.

Check 1: watch the Network tab

  • Open the tool's page. Press F12 (Cmd+Option+I on a Mac) and click the Network tab. Chrome, Edge and Firefox all have one.
  • Click the clear button (the circle with a line through it) so the list is empty.
  • Add a test file and run the tool: merge, compress, whatever it does.
  • Look for requests that sent data out. Uploads show up as POST or PUT requests, often "multipart/form-data". Click one and read Content-Length under Request Headers, or open the Payload tab. A request about as big as your file is an upload. A request of a few hundred bytes (analytics, a licence check) carries no file.

Check 2: go offline halfway

  • Load the tool's page fully.
  • In the Network tab, open the throttling menu (it says "No throttling") and choose Offline.
  • Run the tool on your test file. If you still get your result, the work did not need a server.
  • If it errors, some tools fetch part of their code the first time you use them. Go back online, run it once with the test file, then go offline and repeat.

What the wording gives away

  • "Files are deleted after one hour" or "we never keep your files" describe a server that received the file.
  • An "uploading" progress bar before the work starts.

Both checks show what a tool did in your session, not what it will do next month. For anything sensitive, run them once with a test file before you trust it with the real one.

We build small browser tools. Our Merge PDF tool merges inside the tab. It loads its code from its own site and, when the page loads, makes one small request to check whether you have a Pro subscription, which carries no file data. Its page walks through the same check: merge PDFs without uploading them.

📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.