Some are, and many are fine for a recipe or a holiday photo. The question that decides everything is where the conversion happens. If a site uploads your file to its server, you are trusting that company, and everyone it subcontracts to, with a copy. If the conversion runs in your browser, the file never leaves your device, and you can confirm that yourself in about two minutes.
That is a check you should run on any site, including this one.
What happens when a converter uploads your file
Most converters work in a chain, and each link can keep a copy:
- Your browser sends the file over HTTPS. That protects it on the way, and does nothing once it arrives.
- The server stores it on disk, often at a cloud provider.
- A conversion program, such as LibreOffice or Ghostscript, opens it. Parsing untrusted files is a known source of security bugs, so a poorly isolated server can be a shared risk.
- The output goes to storage and gets a download link. Whoever has the link can usually fetch it, and in many services that link does not require a login.
- Logs, backups and error reports may hold names or fragments of the file for longer than the headline deletion period.
A statement such as “files are deleted after one hour” describes intent. You cannot verify it from the outside, and it rarely mentions backups or staff access.
The other risk: what you download
The danger can also run the other way. In March 2025 the FBI’s Denver field office warned of free online document converters being used to load malware, leading to incidents such as ransomware. According to the warning, these sites often do perform the conversion, so the result looks legitimate. The FBI’s advice is to treat an .exe, .bat or .scr download as a stop sign, and to prefer reputable conversion software.
Sound habits on the download side:
- The output should match what you asked for. If you requested a PDF and received
document.pdf.exe, a ZIP or an installer, delete it. Turn on file extensions in your file manager, so you can see them. Our guide to file extensions covers how disguises work. - Never install anything to convert one document. A browser tool does not need an extension, a desktop “helper” or a notification permission.
- Be careful with ads. Big green “Download” buttons on free sites are often ads. Look at the URL when you hover over the button.
- Keep your PDF reader and Office updated, since a crafted file typically targets an old bug.
- Think before using an online virus scanner. Multi-engine scanning sites are useful, but they can share submissions with security vendors. Do not send them a confidential document. Scan with the antivirus already on your machine instead.
What to check before uploading
| Check | What a good answer looks like | What is a warning sign |
|---|---|---|
| Who runs it | A named company with a real address | No company name anywhere |
| Privacy policy | Says what is kept, how long, and who processes it | Generic, or claims rights over your content |
| Deletion | A specific period and a delete button | ”We may retain files to improve services” |
| Security terms | Details of encryption and access | Only the word “secure” and a padlock icon |
| Business model | Paid plans, or clearly labelled ads | Downloads wrapped in installers |
| Local processing claim | One you can verify with the test below | A claim you are asked to take on trust |
A padlock in the address bar means only that the connection is encrypted. It says nothing about what the site does with the file, and scam sites have padlocks too.
How to verify that a tool really works locally
“Runs in your browser” is easy to claim, so test it. Use a throwaway file for this, not the sensitive one.
Method 1: watch the network
This is the reliable test.
- Open the converter in a desktop browser. Do not choose a file yet.
- Press F12 (or Cmd+Option+I on a Mac) and open the Network tab. Tick Preserve log.
- Clear the list so you start from nothing.
- Choose a test file of a recognisable size, say about 5 MB, and run the conversion.
- Sort by Size or look at each request’s method. You are looking for a
POSTorPUTrequest with a body close to your file’s size. Clicking a request shows its payload.
If you see a 5 MB upload, the file left your device. If you see only small requests, it did not. Requests you may legitimately see include GET requests that download library code to your browser (a PDF library can be several megabytes, but those bytes are coming to you, not going out), analytics pings, and ad requests. Our site, for instance, loads analytics and ads on its pages. None of those carries a file, and small requests like that are easy to tell apart from a 5 MB upload.
Method 2: disconnect
- Load the tool’s page and let it finish loading.
- Turn off Wi-Fi or unplug your network cable.
- Run the conversion.
If you get a result with no network, the work was done on your machine. Close the tab before you reconnect, because in principle a page could send data once it is back online. A failure here proves little: many sites load a library only when you press the button, and that download would also fail. So treat a pass as good evidence, and a failure as “go and run Method 1”.
Method 3: read the size of the job
Slow progress on a large file in step with your connection’s upload speed suggests an upload. Instant results on a 200 MB file suggest it was not sent anywhere. This is a hint rather than proof, and it is worth doing the Network check if the file matters.
Keep in mind that you have only tested one visit. A site can change its code tomorrow, and a browser extension with permission to read pages can see what you see, wherever the conversion runs.
Documents that should never go to an upload-based converter
Do not put these on a server you have no agreement with, however good its policy reads:
- Identity documents: passports, driving licences, national ID and visa scans.
- Financial records: tax returns, payslips, bank statements, card details.
- Medical records, yours or anyone else’s.
- Legal material: contracts under negotiation, anything privileged, court material under restriction.
- Other people’s personal data: CVs you received, customer lists, staff records. You may have legal duties here that an upload could breach, for instance under GDPR.
- Business confidential files: unreleased financials, source code, pricing, anything under NDA. Many employers ban this outright, so check your policy.
- Anything containing credentials, such as a spreadsheet of passwords or an API key in a document.
A test that helps: imagine the file appearing on a public website tomorrow. If that would be a serious problem, do not upload it.
Better options for sensitive files
Software you already have can do most of these jobs, with no third party:
| Job | Local option |
|---|---|
| Word to PDF | Save As or Export in Microsoft Word, or LibreOffice |
| Anything printable to PDF | Print to PDF on Windows, or the PDF button in the Mac print dialog |
| Merge or reorder PDF pages | Preview on a Mac, or Adobe Acrobat |
| Image format changes | Preview, Paint, or the free ImageMagick |
| Spreadsheet to CSV | Save As in Excel or LibreOffice Calc |
A browser-based tool sits between these and an upload service. It is handy when you are on a borrowed machine or lack the right software. Most tools on OnlineTextLab, including Merge PDF, Compress PDF and DOCX to Text, process files in your browser, and you can check them with the method above. The exceptions are the SEO checkers that take a URL: those fetch a public web page through our server, because a browser cannot fetch other sites directly, but they do not take your files.
There is a real trade-off. Local tools are limited by your device’s memory and by what can run in a browser, so a server-side converter can do things they cannot, such as accurately laying out a complex Word document. For a harmless file, that may be the right call. Just choose it knowingly, and keep the confidential files away from it.
A short decision rule
- Would exposure of this file cause harm? If yes, use desktop software or a verified local tool.
- If no, is the site a known company with a clear policy? If yes, go ahead.
- Does the result look like the file type you asked for, and did it ask you to install nothing? If not, delete it and go elsewhere.