How to check in 30 seconds if a PDF site uploads your files

A PDF site tells you your files are “100% private” and “never stored.” Maybe that’s true. Maybe it isn’t. The thing is, you don’t have to take their word for it. Your browser already records every byte a site sends and receives, and you can read that record yourself. It takes about 30 seconds and you don’t need to know how to code.

Here’s the test, step by step, and how to read the result.

Open DevTools first

Every modern browser ships with a developer panel called DevTools. One part of it, the Network tab, lists every request the page makes: images, fonts, scripts, and any file the site sends out.

Open the PDF site you want to check, but don’t drop your file in yet. Then open DevTools:

• Chrome, Edge, Brave, or Firefox: press F12, or right-click anywhere on the page and choose Inspect.
• Safari: turn on the Develop menu first (Settings → Advanced → “Show features for web developers”), then press Option + Cmd + I.

Click the Network tab at the top of the panel. You’ll see a table with columns like Name, Status, Type, and Size. If it’s empty, that’s fine. Find the small “Preserve log” checkbox and tick it so nothing gets wiped, then click the clear button (a circle with a line through it) to start with a clean list.

Drop a PDF and watch

Now do the thing the site is for. Drag a PDF in, or pick a file, and run the action: merge, compress, rotate, whatever the tool does. Keep your eye on the Network tab while it works.

Two things can happen.

The site uploads your file. You’ll see a new row appear right as you start the action. It’s usually a POST request (check the Method column, or click the row). The giveaway is the Size column: if your PDF is 4 MB, you’ll see a request roughly that big leaving your machine. Click the row, open the Payload or Request tab inside it, and you can often see your actual file data sitting there. That’s your document going to their server.

The site keeps it local. You drop the file, the tool does its work, the result downloads, and the Network tab shows… nothing new. No big POST. No request the size of your PDF. The only traffic was the page loading earlier, plus maybe a tiny analytics ping that’s a few hundred bytes, not megabytes. Your file never left the tab.

That’s the whole test. The Size column does most of the talking. A few hundred bytes is housekeeping. A few megabytes that match your file is an upload.

The blunt version: pull the plug

There’s an even simpler check, and it needs zero technical knowledge. Load the PDF site, then turn off your Wi-Fi. Now try to use it.

A tool that processes files on a server will break the moment it can’t reach that server. It’ll spin, time out, or throw an error, because it physically can’t send your file anywhere. A tool that runs in your browser keeps working with the Wi-Fi off, because everything it needs already downloaded when the page loaded. If it still merges and compresses with no connection, your files are staying put. There’s no server in the loop to upload to.

Why reader.me shows no upload

Run that test on reader.me and the Network tab stays quiet. Drop a file into merge PDF, combine a few documents, and you won’t see a request carrying your PDF anywhere. Same with compress PDF: the file gets read into your browser’s memory, recompressed right there, and saved back to your downloads. Turn off your Wi-Fi after the page loads and both still work.

That’s not a privacy slogan, it’s how the tools are built. The PDF engine ships inside the web page and runs on your device. Your file is opened as bytes in memory, changed, and written back out as a new file you download. Nothing is sent to us because there’s no server step that needs it. If you want the mechanics of how a file gets smaller without leaving your machine, the compression glossary entry walks through it.

What you can stop guessing about

The next time a PDF site promises privacy, you don’t have to wonder. Open the Network tab, drop a file, and watch the Size column. Or just kill your Wi-Fi and see if the tool still runs. The browser tells you the truth either way, and it takes less time than reading the privacy policy you were supposed to trust.

Privacy you can check beats privacy you have to believe. Now you can check it.