The Privacy Cost of "Free" Online File Converters

Search for "merge PDF" or "compress image" and you will find dozens of free websites ready to help. Drag, drop, download, done. It is so convenient that most people never ask the obvious question: where did my file just go?

For a holiday photo, maybe it does not matter. For a passport scan, an employment contract, a medical report or a bank statement, it matters a lot.

How most free converters work

The typical flow is simple:

1. Your file is uploaded to the provider's server.
2. The server processes it.
3. You download the result.
4. The provider, ideally, deletes both copies after some time.

Step 4 is where trust comes in. Privacy policies often say files are deleted after one hour, or 24 hours, or "periodically". You have no way to verify that. Files may also pass through third-party cloud storage, logging systems and backups.

What can go wrong

• Retention beyond what is promised. Backups and logs can keep data far longer than the headline deletion window.
• Breaches. Any server storing files, even briefly, is a target.
• Jurisdiction. Your file may be processed in a country with different data protection laws.
• Business model drift. "Free" services need revenue. Policies change, companies get acquired, and data becomes an asset.
• Compliance exposure. Employees uploading client documents to random tools can create GDPR, HIPAA or contractual problems for their employer.

None of this means every converter is malicious. Most are probably fine. But "probably fine" is a weak standard for sensitive documents.

The alternative: processing in the browser

Modern browsers are powerful. With JavaScript and WebAssembly, many file operations can run entirely on your device:

• merging, splitting and reordering PDF pages
• laying out multiple pages per sheet
• compressing, resizing, cropping and converting images
• extracting tables from text-based PDFs

In this model, the website delivers the code, and your computer does the work. The file never leaves your machine.

Several tools now take this approach. FileOtter, for example, offers PDF merge, split, 2-up/4-up layout, PDF to Excel, plus image compression, cropping and format conversion, all processed locally with no upload and no account.

Trust, but verify

You do not have to take any website's word for it. Here is a two-minute check:

1. Open the tool in Chrome, Firefox or Edge.
2. Press F12 to open Developer Tools and select the Network tab.
3. Process a test file.
4. Look for a large outgoing request roughly the size of your file.

If none appears, the processing is local. For extra certainty, disconnect from the internet after the page loads and try again. A truly client-side tool will keep working.

The trade-offs

Local processing is not magic. It has limits:

• Device power. Very large files can be slow on older phones or laptops.
• Heavy operations. Aggressive PDF compression or OCR on scanned documents is harder to do well in a browser.
• Feature depth. Server tools can sometimes offer more advanced options.

For the everyday tasks most people need, these limits rarely matter.

A simple rule for individuals and teams

• Public or trivial files: Use whatever tool you like.
• Personal or confidential files: Use local tools, either desktop software or verified browser-based ones.
• Regulated data: Follow your organisation's approved tools list, and if there is none, ask for one.

Conclusion

The convenience of free online converters has trained us to upload first and think later. As browsers grow more capable, that trade-off is no longer necessary for most tasks. Next time you reach for a file tool, take ten seconds to ask where your file is going, and choose one that keeps it where it belongs: on your device.