Privacy
What happens to your file when you use a free online PDF tool
“Compress PDF”, “PDF to Word”, “Merge PDF”: the first results are websites that do it free, in seconds. They do it on their computers, with your file. Often that’s fine. For a passport scan, a payslip or a medical report, it’s worth knowing what you’re agreeing to.
Online PDF tools work by uploading your file to their servers, processing it there and sending back the result. Reputable ones say they delete files after a short time; iLovePDF, for example, says two hours. The risk is in the rest: copycat sites, and, as the FBI’s Denver office warned in March 2025, fake converters that hand back malware along with your file. For sensitive documents, use a tool that runs on your own device, and check it by turning off Wi-Fi.
How online tools work
When you drop a PDF on a website, the whole file travels to a server, gets converted, compressed or merged there, and comes back. That means for a while a copy exists outside your control, on infrastructure you can’t see, under a privacy policy you probably didn’t read.
Some companies are clear about it. iLovePDF, one of the most used, says it processes files on its servers and deletes them after two hours, and keeps signed documents in its signing service for longer. That’s a reasonable policy, and it’s still a copy of your document on someone else’s computer.
The FBI’s warning about fake converters
On March 7, 2025, the FBI’s Denver field office warned that criminals were using free online document converter tools to load malware onto victims’ computers, which could lead to ransomware or identity theft. The tools often did the conversion they promised, so nothing seemed wrong. Security companies including Malwarebytes reported on the warning and the sites involved. The FBI advised being wary of converters that return executable files instead of documents, and reporting incidents to IC3.gov.
Documents that shouldn’t go to a stranger’s server
- IDs and passports, and scans of them.
- Bank statements, payslips and tax forms.
- Medical reports and prescriptions.
- Contracts under negotiation, and anything covered by a confidentiality agreement.
- Client documents, if you’re a lawyer, accountant or consultant. Your professional rules may decide this for you.
The 10-second test
Turn off Wi-Fi and mobile data, then try the tool. If it still works, it runs on your device. If it waits forever or asks you to sign in, the processing happens somewhere else. This also catches desktop and mobile apps that look local but quietly send files to a server. For example, a 2019 Office Watch report says Word for Mac’s PDF conversion is done by Microsoft’s online service.
Safer habits
- Prefer tools built into your system or apps that work offline.
- If you must use a website, use a known one, check the address carefully, and remove personal details first.
- Never run a file you got back that isn’t a document (.exe, .bat, .scr, .dmg, .pkg).
- Read the retention line of the privacy policy: how long they keep files, and whether they use them for anything else, such as training AI.
Everything in Keepsign runs on your iPhone, iPad or Mac: compressing, converting to Word and Excel, OCR, redaction and the AI. There’s no account and no Keepsign server, so there’s nowhere for your document to go. It passes the Wi-Fi test. The only network requests are ones you start, like checking whether a certificate was revoked, and the privacy page lists them all. Conversions on your device.
Sources
- FBI Denver Field Office, warning on free online document converters, March 7, 2025, as reported by Malwarebytes: malwarebytes.com/blog/news/2025/03/warning-over-free-online-file-converters-that-actually-install-malware
- iLovePDF, Features and Security pages: ilovepdf.com/features and ilovepdf.com/help/security (files deleted after two hours), read November 4, 2026.
- Office Watch, “So-called Edit PDF feature is coming to Word for Mac”, 2019, office-watch.com.