Why sensitive PDFs should not be uploaded anywhere — and what browser-based tools change

At the end of 2025 a recruitment platform was exposed for "uploaded CV PDFs being reachable, unredacted, in a test environment". The vendor said it had been fixed, but an HR friend still asked me: how safe are online PDF tools, really? Here is the whole argument.

The three kinds of PDF I am most careful with

1. Employment contracts and quotes: they carry amounts, clauses and signatures.
2. CVs and scans of identity documents: an extremely dense concentration of personal data.
3. Financial receipts and bank statements: strict compliance requirements, and heavy consequences if they leak.

For these three, I never upload to a "free online PDF converter" whose name I have never heard.

The risks of the classic upload-based tool

• The file is uploaded to a server: HTTPS on the way does not stop the server from keeping it.
• The retention time is unclear: some say one hour, some say "up to 24 hours", and some say nothing at all.
• Data leaving the country: a server abroad means a cross-border transfer, which compliance may simply refuse.

That is not to say every upload-based tool is evil. It is that sensitive documents are not worth gambling on.

What "processed in the browser" means

Take TwoThink: JavaScript and WebAssembly run the logic for merging, encrypting and the rest on your own computer, so the bytes never leave the browser. Close the tab and the data in memory is gone; no server means no server-side retention.

That is particularly useful for HR, finance and freelancers: process, download, and the trail stays on your machine.

[Image: the browser developer tools Network panel, with no file upload while a PDF is being processed]

How it relates to "no sign-up"

Not signing up shrinks the account-breach surface; not uploading shrinks the file-breach surface. Only the two together are a sensible posture for sensitive PDFs. Our tool review compares several services on exactly these points.

Practical advice

1. Encrypt before sending: set an open password with Password Protect PDF, and never send the password with the file.
2. Merge rather than send many files: combine several CVs into one file for internal sharing so there are fewer copies in circulation.
3. Follow your company's rules on company machines: where DLP is in place, use the approved solution; personal tools suit personal documents.
4. Be careful on public Wi-Fi: local processing still means loading a web page, and a hostile hotspot can hijack it — save sensitive work for a network you trust.

How to tell whether a tool uploads

Open the developer tools → Network → process a PDF and watch for a large multipart/form-data request flying to an unfamiliar domain. While TwoThink processes a file you should not see the PDF being POSTed anywhere.

The end

For a sensitive PDF, leakage cost comes first, convenience second. Browser-based tools push the risk back inside your own machine, and that is one of the reasons I keep building TwoThink.

Process your next contract safely → try Merge PDF or Password Protect PDF, and open the Network panel yourself to check.