After disconnecting
14/14 completed the operation and downloaded a valid result.
Privacy Lab · reproducible evidence
Privacy demonstrated with tests, not promises
We audited all 14 published tools with synthetic documents. The test loads the tool first, disconnects Internet, and only then selects and processes the file.
Audit V2 · 2026-08-30 · production · commit 9a5ebf9
Online control
14/14 completed the same flow under network monitoring.
Processing requests
0 offline and 0 in the online control.
Document transfer
0 requests carrying fixture data and 0 external origins.
What the data support
- Tools keep processing locally if the connection is lost after they have loaded.
- No document transfer was detected in the synthetic online control.
- No external processing origins were detected.
- No processing network requests occurred in the online control.
- Offline processing remained completely silent on the network.
Methodology
The sequence avoids a misleading test where the file is selected before the connection is cut.
- Open the tool online and wait for its resources.
- Take the browser offline.
- Select the local synthetic PDF or image after the cut.
- Run the real operation and confirm the download.
- Repeat online while checking requests, attachments, canaries and external origins.
Result by tool
PASS = completed flow and valid download. PDF Protection was tested in protect mode.
| Route | Offline after load | Online control | Processing req. |
|---|---|---|---|
/unir | PASS | PASS | 0 / 0 |
/dividir | PASS | PASS | 0 / 0 |
/extraer-texto | PASS | PASS | 0 / 0 |
/desproteger · protect mode | PASS | PASS | 0 / 0 |
/rotar | PASS | PASS | 0 / 0 |
/metadatos | PASS | PASS | 0 / 0 |
/organizar-pdf | PASS | PASS | 0 / 0 |
/marca-de-agua | PASS | PASS | 0 / 0 |
/comprimir | PASS | PASS | 0 / 0 |
/numerar | PASS | PASS | 0 / 0 |
/imagenes-a-pdf | PASS | PASS | 0 / 0 |
/pdf-a-imagenes | PASS | PASS | 0 / 0 |
/firmar-pdf | PASS | PASS | 0 / 0 |
/recortar-pdf | PASS | PASS | 0 / 0 |
How we interpret “zero transfer”
It does not mean a website never makes requests. During the audited processing phases there were no processing requests, and the synthetic document, its canary and its bytes did not appear as a network body or attachment.
Stats Lite was handled separately: DNT/GPC were simulated and only /__stats-hit was blocked so the audit would not pollute statistics. An anonymous visit signal is not a PDF upload.
What we have NOT tested
- Cold-starting PDFPrivado with the browser already offline.
- Every browser, operating system and hardware combination.
- Real user documents: the audit uses synthetic fixtures.
- Every possible sub-mode; PDF Protection was exercised in protect mode.
Fully offline cold start: NOT_TESTED.
Public evidence and reproducibility
We publish a sanitized technical summary, hashes and methodology. The raw ZIP is not public because it contains local paths and internal test material.
SHA-256 raw audit ZIP (not public): 8d79f1add93b2735689a17260de39d4eb0d42d7b2658dbfa7113b916438e435f
Representative screenshots
Offline runs with synthetic fixtures. Screenshots are complementary evidence; counters come from the structured report.
/unir · offline
/desproteger · protect mode · offline
/pdf-a-imagenes · offline
/recortar-pdf · offlineEquivalent manual test
Load a tool online, wait until ready, turn off Wi‑Fi, choose the file and process it. This is the claim we validated.
PDF privacy observatory · Study V1
Does your PDF tool upload your documents? Reproducible test of 5 online PDF services
We measured one operation only —Merge PDF— with two synthetic documents, the same method, and a second run with network disabled after preloading each tool.
Tests performed on September 5, 2026
| Service | Was PDF transfer observed? | Completed offline after preload? | Observed result |
|---|---|---|---|
| UMyPDF | Not observed | Yes | Local processing verified |
| Smallpdf | Yes | No | Remote document transfer verified |
| iLovePDF | Yes | No | Remote document transfer verified |
| PDF24 Tools | Yes | No | Transfer + remote merge request |
| Adobe Acrobat Online | Yes | No | Remote document transfer verified |
How to read this table
We do not label services “safe” or “unsafe”. We publish observed facts for one tool, date and operation. Web telemetry and document transfer are recorded separately.
Study limitations
Only Merge PDF was tested. Results are not extrapolated to other tools or desktop apps. Offline testing started after the web tool was preloaded; a fully offline cold start remains untested.
Evidence summary
UMyPDF
The merge completed online and after network cutoff following preload. We observed no canary PDF transfer and the result was delivered as a local blob.
Smallpdf
We observed two PUT requests to remote storage for .pdf objects. Offline, the interface reported that the files could not be uploaded.
iLovePDF
We observed two POST requests to /v1/upload of about 462.6 KB each, both returning HTTP 200.
PDF24 Tools
We observed two upload POST requests followed by a remote joinPdf request returning HTTP 200.
Adobe Acrobat Online
We observed asset metadata containing canary markers and application/pdf PUT transfers of about 461.3 KB to temporary Adobe storage.
Reproduce the test
Download the same canary PDFs, method, data and sanitized network evidence. They contain no personal data. Signed URLs and temporary tokens are removed from the public dataset.
Control screenshots
Only Merge PDF was tested. Results are not extrapolated to other tools or desktop apps. Offline testing started after the web tool was preloaded; a fully offline cold start remains untested.