The two minute check
You found a free site that merges or compresses PDFs, and the file you need to drop on it holds a signature, a passport number or tax figures. Whether that is safe comes down to one question: does the tool work on your device, or on the site's server? You can find out yourself, for any tool.
- Open the tool page, then your browser's developer tools: press F12, or Ctrl+Shift+I on Windows, or Cmd+Option+I on a Mac.
- Click the Network tab and clear the list. Make sure the filter says All.
- Add a harmless PDF of 10 MB or more and run the tool. An upload that size is hard to miss.
- Look at the new rows. A file upload is a request with the method POST or PUT whose Content-Length, under Request Headers, is close to your PDF's size. The Size column shows the reply, which is usually tiny. Click a row and read its Headers and Payload (or Request) tabs.
- If no request carried your PDF, whole or in pieces, and the finished file still appeared, your browser did the work.
What upload means, and what a site could do with your file
When a tool uploads your PDF, your browser sends a copy over the internet to a computer the site's operator controls. That computer does the work and sends a result back. Many free PDF sites work this way. A secure connection, shown as a padlock in many browsers (recent Chrome shows a settings icon instead), means the trip is encrypted. It says nothing about what happens once the file arrives.
Depending on the site, any of these can be true of a copy that sits on someone else's server:
- It is kept for minutes, days or longer, and copied into backups and logs.
- People who run the service or its hosting can open it.
- Other companies that run parts of the service receive it.
- It is used for more than your job, if the policy allows, such as improving the service.
- A security problem or a legal request exposes it.
That does not mean a particular site does any of this. It means you cannot see from outside, so the written policy and your own test are all you have.
What to read before you trust a site
- Does the policy mention uploaded files? A page about cookies that never says what happens to documents has not answered the question.
- When are files deleted? "Within one hour" is a clear promise. "Periodically" or "as long as needed" is not.
- Who else receives the file? Look for third parties, processors, partners and affiliates.
- Is it used to improve the service? Look for analytics, research and training.
- Does the result sit behind a link? If so, who can open that link?
How to prove a tool does not upload
Chrome and Edge
Press F12, or Ctrl+Shift+I on Windows, or Cmd+Option+I on a Mac, and open Network. Click the clear button (the circle with a line through it) and tick Preserve log. Run the tool, then click any row: Headers shows the method and the Content-Length of what was sent, and Payload shows the content.
Firefox
Press F12, or Ctrl+Shift+E on Windows, or Cmd+Option+E on a Mac, to open the Network panel. Run the tool and watch the Method column for POST or PUT rows. The Transferred column shows the reply, not what you sent. Click a row, then Headers for Content-Length, or Request for what was sent.
Safari
Safari hides its tools. Open Settings, then Advanced, and tick Show features for web developers (older versions call it Show Develop menu in menu bar). Then choose Develop, Show Web Inspector (Option+Cmd+I) and open Network. If there is no Method column, right-click the column headers to add it.
A test with no tools
Run the tool once online, then switch off Wi-Fi and run it again. If the job still completes, nothing needed a server. Some tools fetch code when you first add a file, so a failure offline proves nothing, and ClipLime does not promise that every tool works offline. It is a handy second opinion on a phone.
What you may see that is harmless
A page loads scripts, styles and images with GET requests, which bring data to you. Small POST requests of a few hundred bytes are usually counters, and clicking one shows its payload. On ClipLime, a finished job sends one to /api/stats carrying a word for the kind of file (for example pdf) and, for a batch, a count, never the file or its name. Scrolling to the footer loads a badge image from another site. The privacy page explains each.
Which PDF jobs need no server at all
A modern browser can read a PDF from your disk, change it in memory and hand it back as a download. ClipLime's PDF tools work this way:
- Merge PDF joins files and lets you pick and reorder pages.
- Split PDF cuts one file into several by page, range or bookmark.
- Reduce PDF size recompresses the pictures inside, which is what makes most PDFs big.
- Rotate PDF turns all, odd, even or selected pages.
- Remove PDF metadata takes the author, program and dates out of the file.
Page numbers work the same way, as the guide to adding page numbers to a PDF shows. Two limits: ClipLime does not read text from scanned pictures (OCR), and it does not open PDFs protected by a password or permission settings.
Which option for which document
| What is in the PDF | If a copy sits on a stranger's server | What to use |
|---|---|---|
| ID, passport, bank statement, tax return | High risk. The numbers are hard to change. | A tool you have checked runs in the browser. |
| Contract, legal letter, medical report | High risk. Private to you and often to others. | The same. Check your own or your client's rules. |
| Work files that belong to an employer or client | Depends on the agreement you signed. | Ask first, or keep the work on your device. |
| A CV with your address and phone | Medium risk. You chose to share it, but not with every server. | A browser tool, or a service that states a deletion time. |
| A flyer or menu that is already public | Low risk. Nothing in it is secret. | Any tool you like. |
What ClipLime still downloads
Your browser downloads the page and the tool's own code, like it does for any website. After that, the code reads your PDF from your disk, works on it in your browser's memory and returns the result as a download. The only other requests you should notice are the counter and the footer image described above.
What a local tool cannot do for you
- Protect the result. A merged PDF in your Downloads folder may be copied by a backup or cloud drive app, and anyone using your computer can open it.
- Remove hidden details. Author names, program names and dates can stay inside a PDF unless you remove them. See what your PDF reveals about you.
- Cover what happens next. Attaching the PDF to an email or chat message is an upload to that service.
The usual local jobs are combining PDFs, shrinking one to fit a size limit and turning a sideways scan. The same habit of checking before you trust applies to links you cannot read, and is that QR code safe shows how to look at one before you open it.