HTTPS does not mean your PDF is not uploaded to a server
The browser padlock matters, but it is often misunderstood. HTTPS protects communication between your browser and a server; it does not by itself tell you whether a document stays on your device.
The short answer
A website can use HTTPS while uploading your PDF to a server. HTTPS encrypts that transfer while it travels across the network. To know whether the file leaves your device, observe the actual application workflow.
What HTTPS actually does
- Encrypts communication between your browser and the server.
- Helps prevent third parties from reading or modifying data in transit.
- Uses certificates to help verify the expected domain.
- Protects small requests and complete file transfers alike.
What HTTPS does NOT prove
- It does not prove PDF processing happens in your browser.
- It does not prove the file is never uploaded.
- It does not describe retention after a provider receives the document.
- It does not tell you which infrastructure may handle the file afterwards.
- It does not turn remote processing into local processing.
Two HTTPS websites can handle the same PDF very differently
Flow A · local processing
- Open the tool through HTTPS.
- Required code loads in the browser.
- Select the PDF.
- The operation runs on your device.
- The document does not need to be uploaded for that operation.
Flow B · remote processing
- Open the tool through HTTPS.
- Select the PDF.
- The browser encrypts the transfer with HTTPS.
- The PDF travels to the server.
- The server processes it and returns the result.
Both services can show HTTPS, a padlock and messages such as secure connection. The privacy difference is what happens to the file after selection.
How to check whether HTTPS is carrying your PDF
Use browser developer tools and a synthetic test document.
- Use a test PDF with no personal information.
- Fully load the tool.
- Open the Network panel.
- Select the PDF and perform a real operation.
- Look for large POST and PUT requests.
- Inspect Content-Type such as application/pdf or multipart/form-data.
- Check upload, file, document, convert or storage endpoints.
- Distinguish small analytics events from transfers similar in size to the PDF.
Offline testing gives another useful signal
Load the tool first, disconnect, then select the PDF. If the operation completes under those conditions, that supports local processing for the tested flow. It does not automatically cover every feature.
So what is the padlock for?
The padlock remains important. When communication with a server is required, HTTPS protects that communication in transit. The mistake is treating encrypted connection as meaning the file never leaves the device.
Privacy questions begin after the padlock
- Does the operation require document transfer?
- Where is it processed after upload?
- Is temporary storage used?
- When is the file deleted?
- What retention policy applies?
- Which providers or subprocessors may access it?
What we observed in PDFPrivado testing
In PDFPrivado's published audit, all 14 tested tools completed their flow after preloading the tool, disconnecting the network and then selecting synthetic documents. The equivalent online control observed no document transfer during processing. A fully offline cold start was not tested.
Related guides
Frequently asked questions
Does the padlock mean my PDF stays on my computer?
No. It means the HTTPS connection is encrypted; an entire file can travel through that connection.
Can an HTTPS upload be seen in Network tools?
You can normally observe the request, destination, method, type and size even though the Internet transport is encrypted.
Would uploading without HTTPS be worse?
Yes. Documents should be protected in transit. But HTTPS does not answer whether uploading is necessary.
Can HTTPS and local processing coexist?
Yes. An application can load through HTTPS and then process documents locally in the browser.
Published and verified: September 6, 2026