What Browser-Only Processing Protects

Every tool on this site that touches a file does the work in the page you have open. That's a real property with a real benefit, and browser-based file tools as a group oversell it all the time. So here's the narrow claim, what supports it, and the things it deliberately doesn't cover.

The narrow claim

When you pick a PDF, the browser's File API gives the tab a readable handle to the bytes on your disk. Those bytes are read into the tab's memory, and a library running in that tab rewrites them: pdf-lib for structural work, pdf.js for rendering pages, JSZip for packaging multiple outputs. The result is assembled as a Blob, given a temporary object URL, and handed to the browser's download machinery.

At no point in that sequence is there an HTTP request carrying your document. No server receives it. There's no queue for it to wait in, no temporary directory for it to land in, and no retention period you have to trust anybody about. The file never becomes somebody else's problem because it never becomes somebody else's file.

That property covers what most people are actually worried about when they hesitate over a tax return, a bank statement or a scan of a passport. It's worth having, and it's all we're claiming.

Check it yourself

You don't have to take this on faith, and you shouldn't take it on faith from any site.

Open your browser's developer tools before you start, switch to the Network panel, then run the job. You're looking for an outbound request with a payload roughly the size of your file. On a page that really does process locally there's nothing. The code and fonts load, and then the network goes quiet while the work happens.

That method has two caveats, because a check presented as proof is worse than no check. Something determined to exfiltrate a file could send it slowly in small pieces, and spotting that in ordinary traffic takes more than a glance at the panel. And the check only tells you what happened during that one run on that one day. It's a good sanity test, but it isn't an audit.

Four things it doesn't mean

It doesn't mean offline. The page arrives over the network like any other, and the heavy libraries aren't in the initial bundle. Each one is fetched on first use, so the code for the watermark tool downloads the first time you watermark something. Disconnect after loading the site and any tool you haven't already used will fail to fetch what it needs. There's no service worker here and nothing to install, so nothing has been cached for later on purpose.

It doesn't mean nothing else is running on the page. This site loads Google Analytics and Google AdSense, and it loads them only after you've accepted in the consent banner. Decline and neither script is injected at all. When they do load, they run in the same page as the tool. They can't reach your file: the File object and the Blob are held in the page's own JavaScript scope, and another script has no way to get them unless the code deliberately hands them over. They do, however, see that a browser visited this address. That's a different kind of privacy from document privacy, and it would be dishonest to blur the two.

It doesn't mean encrypted. Bytes sitting in a tab's memory are plain bytes. The output that lands in your Downloads folder is a plain file that anything on the machine can open. The one place real cryptography comes in is Protect PDF, which encrypts the document itself with a key derived from your password. Local processing and encryption are unrelated, and having one tells you nothing about the other.

It doesn't protect you from your own machine. A browser extension with access to page content sits inside the same boundary as the tool. So does anyone else who uses a shared login on that computer, or an employer's management software on a work laptop. If your Downloads folder syncs to a cloud drive, the output you just kept off one company's servers is now on another's. The weak point is shared or managed devices, not the network.

What it costs

Local processing isn't free, and the costs fall on you, not on us.

Everything happens in tab memory. That's why there are size limits (100 MB for a single file), and why a phone will kill the tab on a very large render long before a server would have struggled. Rendering is slow because it runs on your processor. There's no optical character recognition, because a usable OCR model isn't something you'd download into a browser tab. A server-side service with a rendering farm behind it can do things these pages can't, and for some jobs that's the right trade.

Put simply: your document isn't uploaded and no copy of it exists on our infrastructure. Every other privacy question you have is about your browser, your extensions, your machine and your download folder.

If you want to see it for yourself, Merge PDF is the simplest case. Pick two files, watch the Network panel stay quiet, and check the result.