The usual model
Your file → upload → their server → download → you
Your document sits on someone else's disk for as long as their retention policy says. You are trusting a privacy policy, not an architecture.
Verify it yourself in 30 seconds
Every PDF site claims your file is safe. Don't take our word for it: open your browser's Network tab, run a tool, and watch the request list. Your file will never appear in it — because it never leaves your device.
How BytesPDF compares with a server-based tool
BytesPDF
Your file → your CPU → your browser tab → you
No upload step exists to trust. The processing happens on the machine in front of you, and the finished file downloads straight back to it.
The 30-second test
Works in Chrome, Edge, Firefox and Safari on desktop. Keyboard shortcuts below are for Chrome and Edge; Firefox and Safari use the same panels.
- 1Open any toolStart with Compress PDF or Merge PDF. No account, no signup — the page works immediately.
- 2Open DevTools and click NetworkWindows/Linux: press F12, or Ctrl + Shift + I. Mac: press Cmd + Option + I. Then choose the Network tab.
- 3Clear the list and tick Preserve logClick the clear/cancel icon so you start from zero, and enable Preserve log so nothing is dropped during the run.
- 4Drop your PDF and process itPick a real file — a bank statement, a contract, anything. Press the tool's action button and let it finish.
- 5Read the request listEvery row is something the page fetched: its own JavaScript, WebAssembly codecs, fonts and worker files. None of them is your PDF. Nothing here posts your document anywhere.
- 6Try the size filterIn the Network filter box, type "larger-than:100k" (Chrome/Edge) or use the size column in Firefox and Safari. The result: no request roughly the size of your file. If your 12 MB PDF had been uploaded, you would see a 12 MB request.
What you will see — and what it means
We would rather explain every row in that list than let you wonder about one.
Requests for the site's own code
JavaScript, CSS, WebAssembly codecs and web-worker files served from bytespdf.com. These are the tools themselves — they have to download once before the work can happen on your device.
Analytics pings (only if you accepted analytics)
Page views and coarse tool/download events. They carry no PDF bytes, no filename, no file size and no account ID. Decline analytics in the consent banner and they stop entirely.
Supabase auth calls — only if you choose to sign in
Account and Pro subscription data. Nothing to do with your documents: there is no upload endpoint for PDF content on BytesPDF.
No request containing your file. Ever.
That is the whole architecture. There is no server-side upload API for document content, so a breach cannot leak files we never received.
The offline proof
Load a tool page once while you are online, then switch off your Wi-Fi (or tick offline mode in DevTools) and compress a PDF. It still completes. A tool that sent your document to a server could not finish the job with no connection — this is the shortest disproof of "upload first, trust us later" we know.
BytesPDF needs a connection to load the site and its code. Once the code is in the tab, your document needs nothing from us.
Questions people ask after they run the test
Is my file really not uploaded?
No. Your PDF is read into this tab's memory and processed there using WebAssembly. BytesPDF has no server-side upload endpoint for document content, so your file cannot reach us. The Network-tab test above shows the proof on your own machine, not on ours.
What happens to my file after processing?
It stays in this tab's memory until you close or reload the page, then the browser releases it. BytesPDF never stores it, never backs it up and never writes it to browser storage. The copy you download lives wherever you saved it, on your device.
Do I need an account or an email address?
No. Every core tool is free end to end: drop a file, process it, download it. There is no signup wall, no email confirmation and no watermark on the output. BytesPDF Pro — an optional subscription for target-size compression, batch jobs, OCR and signatures — does need an account, because that is how a subscription is linked to you.
Does the offline test really prove anything?
Yes. Load a tool page once, then turn off your Wi-Fi (or use your browser's offline mode) and compress a PDF. It still works. A tool that uploaded your file could not complete the job with no connection.
What can't this test prove?
Your device is still part of the security boundary: your operating system, browser, extensions, and what you do with the downloaded file afterwards are all outside our control. This page proves one specific claim — that BytesPDF does not receive your document. See the Security page for the full threat model.
Still sceptical? Good.
Scepticism is the correct default for a tool that touches your contracts, bank statements and medical records. Keep testing us: run the Network-tab check on any page, any time. If you ever see a request carrying your document, email security@bytespdf.com and we will publish the finding.