Why nothing you open here is ever uploaded
Nothing you open here is uploaded. The file is read from your own disk, worked on in memory, and handed back as a download. No server ever receives it, and closing the tab discards everything.
Most free PDF tools work the same way underneath: you pick a file, the browser posts it to a server, something happens on that server, and a link comes back. That model is not evil — it is just how you build a PDF tool if you want it to run anywhere. But it does mean a copy of your document sits on somebody else's disk for as long as their retention policy says, and you have to take their word for what that policy is.
This site does it the other way round. The PDF never moves.
What actually happens when you drop a file in
When you choose a file, the browser hands the page a File object. That object is a handle to bytes on your own disk — not a copy on a server. The page reads those bytes into an ArrayBuffer, which is memory belonging to that one tab.
From there, two libraries do the work, and both of them are ordinary JavaScript running in that tab:
- pdf-lib parses the PDF structure and writes a new one. Merging is copying page objects from several documents into a new document; rotating is setting a value on a page dictionary; deleting is leaving pages out of the output. None of it needs a server, because a PDF is a document format, not a service.
- pdf.js renders pages to a canvas so you can see what you are about to change. It is the same engine Firefox uses to display PDFs, which is a decent hint that a browser is a perfectly capable PDF environment.
When you press the button, the result is assembled as a Blob, a URL is created for it with URL.createObjectURL, and your browser downloads it. That is why the download appears instantly instead of after a wait — there is no round trip to wait for.
The difference this makes, concretely
| Server-side tool | This site | |
|---|---|---|
| Where the file goes | Uploaded to their infrastructure | Stays on your disk and in your tab |
| Who can read it | Anyone with access to that server | You, and whoever can already read your disk |
| Retention | Whatever their policy says | Discarded when you close the tab |
| Works offline | No | Yes, once the page has loaded |
| Account required | Usually, eventually | Never |
The offline point is worth sitting with, because it is the easiest way to prove the claim to yourself rather than believe it. Load any tool on this site, turn off your wi-fi, then merge two PDFs. It works. A tool that uploads cannot do that, and no amount of privacy copy changes it.
What we do not have
There is no analytics on this site — no Google Analytics, no Plausible, no Matomo, nothing that records what you opened. There is no account system, so there is nothing to log in to and no profile to attach a file to. There is no server-side code at all: the whole thing is static files on GitHub Pages, which means there is no request handler that could receive a document even if someone wanted to write one.
Being precise: your browser does make requests. It has to fetch the page, the stylesheet, the fonts and the PDF library in the first place. Every one of them comes from this site and nothing else — the typefaces used to be loaded from Google, and are now served from here, so no third party sees that you visited at all. Once those files have arrived, working on a document adds no further request. What never gets sent, at any point, is the contents of your PDF.
The tool where this matters most
Filling in a form is the case where uploading feels worst, because the thing you are typing is usually the sensitive part — an ID number, an address, a signature. Fill a PDF form without uploading it handles both kinds of form: real interactive AcroForm fields, and flat scans with no fields at all, where you click on the preview to place text exactly where a line is printed.
It also embeds a Noto Sans TC subset covering Big5-HKSCS and GB2312, which means Traditional and Simplified Chinese come out as characters rather than boxes — including the Hong Kong supplementary set, so 深水埗 and 紅磡 write correctly. The font file is served from this domain. And you can draw a signature with a mouse or finger and stamp it onto the page. All of that happens in the tab.
Where the limits are
Running in a tab has a real cost, and it would be dishonest to skip it. Everything lives in your browser's memory, so files are capped at 50 MB each and 20 files at a time. A very large scanned document can make an older phone struggle. And because there is no server doing the work, there is no queue you can leave running while you close the laptop.
Those are the trade-offs. We think they are the right ones for documents that were never anybody else's business.
Next: merge PDF without uploading · fill a PDF form without uploading · compress a PDF without upload · Privacy Policy