Where does your PDF go when you use an online tool?

Pick in thirty seconds

Imagine you need to shrink a 22 MB scan called tenancy-agreement.pdf before a letting agent's portal closes at midnight. The file holds your signature, your bank details and your passport number. That is a tab job: open the compressor, set the target the portal asks for, and download the result. The document never crosses the network, so there is no upload queue and no retention policy to trust.

Now imagine the same evening you also need the text inside a photographed contract turned into searchable words. No tab can do that well today, so that half of the evening belongs to a server tool or a desktop app with text recognition. Same person, same night, two different right answers. The rest of this page explains how to tell which half you are in.

The two models side by side

Every online PDF tool sits in one of these two camps, and vendors rarely label the camp on the front page. Here is what actually changes between them.

When the upload is worth it

Text recognition tops the list. Turning photographed words into searchable text needs models that are far too large to ship inside a web page, and PDFGym simply does not offer it. If your PDF holds photographed pages instead of real text, go to a server suite or a desktop app and do not feel bad about it.

Formatted Office conversion sits next to it: rebuilding a PDF as a Word or Excel file with layout kept needs engines nobody runs in a tab. Text-first conversion without the layout runs locally instead. After that come the scale jobs. A 400-page catalogue that needs reprocessing for twenty minutes will outlast most people's patience with an open tab, and signing with a hardware certificate needs a trust anchor that lives outside your browser anyway. For any of these, the upload is the price of a capability, not a design flaw.

Jobs that never need to leave your computer

Everything structural about a PDF runs fine locally. Shrinking a file to a stated size, joining several files, reordering or dropping pages, fixing rotation, building a PDF from photos, exporting pages as images, stamping headers, blacking out passages for good and stripping hidden metadata all work on the bytes in front of you. The browser is fast enough for each of them, and skipping the round trip often makes it faster than the server in wall-clock time.

There is also a third route for teams: run the server yourself. Stirling PDF publishes its toolset for your own infrastructure or air-gapped use, stating files never leave in that setup, with more than thirty million downloads claimed. That is the strongest privacy story in the category, and its cost is a machine plus someone who keeps it patched.

Check any tool yourself in a minute

Vendor pages describe privacy in soft words, so test instead of trusting. Load the tool with developer tools open on the network tab, then choose a file and keep your eyes on the requests. If the document leaves your machine, an upload entry shows up right there. No sentence on a landing page is as reliable as that one observation.

The second test is even simpler: disconnect from the internet and run the tool again. A browser tool keeps working because the code already sits in the tab. A server tool stops dead. How PDFGym works describes which side of that line every tool here sits on, and the privacy page states that nothing is measured and no cookie is set unless you accept analytics in the cookie bar.

How we checked

We read vendor privacy and pricing pages for the retention claims quoted above (TinyWow's one-hour deletion for processed and unprocessed files alike, and Xodo's retention notice without a fixed deletion hour, both checked 10 September 2026), and we read the PDFGym tool pages and their code in this site's own repository. No accounts were created, no files were uploaded anywhere, and no speed tests were run, so treat this as a reading of published statements plus knowledge of what runs in a tab, not as lab-tested timing.