Are online file converters safe? What really happens to your files
“Files are deleted after one hour.” Maybe they are. The real issue is that you have no way to check — and you do not have to rely on that promise at all.
Updated · 4 min read
Free online converters are among the most used tools on the internet. People use them for exactly the files they should guard most closely: passports, bank statements, medical results, contracts, pay slips. Most of these services are run by honest companies. But it is worth understanding what happens to a file when you click “upload”, because the answer is the same for honest and dishonest services alike.
What happens when you upload a file
- Your file is sent over the internet to the service’s server, usually encrypted in transit.
- It is stored on that server, at least for the time the conversion takes.
- The server converts it and stores the result.
- You download the result. At some later point, the service says, both copies are deleted.
Steps 2 to 4 happen on a computer you cannot see. You do not know where it is, who can access it, whether backups or logs keep a copy, or whether the deletion actually runs. A privacy policy describes intentions; it does not let you verify them.
The real risks
- Breaches. Any server that holds files can be attacked. Converters are attractive targets precisely because of what people upload.
- Retention and logs. Files can survive in backups, caches or error logs long after the promised deletion.
- Jurisdiction. The server may be in a country with different data-protection rules from yours.
- Secondary use. Some terms of service allow uploaded content to be used to improve the service — including, increasingly, to train models.
- Look-alike sites. Fake converters exist to collect documents or deliver malware in the “converted” download.
The alternative: processing in the browser
Modern browsers can run complex software. Reading and writing PDFs, compressing images, building spreadsheets and even running small AI models can all happen on your own device, inside the web page. A tool built that way downloads its code once and then works on your file locally. There is no upload, so there is nothing to delete, nothing to breach and nothing to trust.
How to check for yourself
You do not need to believe any website — including this one. Two simple tests show whether a tool sends your file anywhere:
- The Network tab. Press F12 (or right-click and choose Inspect), open the Network tab, then use the tool. You will see the page’s scripts, images and analytics. If your file is uploaded, you will see a request roughly the size of your file going out. If not, there is none.
- The offline test. Use the tool once while connected, so it loads everything it needs. Then disconnect from the internet and use it again. A tool that uploads files stops working; a tool that runs in your browser keeps going.
Other safe options
- Your operating system already does a lot: “Print to PDF” on Windows and macOS, and Preview on Mac can combine, rotate and export PDFs.
- Office suites export to PDF and open most formats.
- For the most sensitive documents, the safest file is the one that is never converted at all — ask whether the recipient can accept the original.
One more thing: browser extensions
An extension with permission to “read and change data on all websites” can see what you open in any page, including files you load into a browser-based tool. Keep extensions to the ones you actually need, especially on the computer you use for documents.
Frequently asked questions
Are paid converters safer than free ones?
Not necessarily. Paying changes the business model, not where your file goes. If the conversion happens on a server, the same questions about storage and access apply.
Is HTTPS enough to protect my file?
HTTPS protects the file while it travels. It says nothing about what happens once it reaches the server.
How can a website work without uploading my file?
The page downloads its code — for example a PDF engine — and your browser runs it. Your file is read from your disk into the browser’s memory and processed there, the same way a desktop program would do it.
Does the offline test prove everything?
It proves the conversion itself does not depend on a server. Combined with the Network tab, where you can see every request the page makes, it is the most reliable check available to an ordinary user.