Which free file tools upload your file? We tested 29.

• The “never uploaded” promises held. All 14 sites that say files stay on your device, including Xodo, BentoPDF, Squoosh and imgkilo, finished the job without sending the file, in both runs.
• Choosing a file is often enough to send it. On 9 of the 10 sites that upload, the file left between 0.05 and 2.5 seconds after it was chosen, before any button was pressed. If you pick the wrong file and close the tab, it has already been sent.
• Most uploaders say so. Smallpdf, PDF24, Sejda, PDF Candy, Soda PDF, TinyPNG and FreeConvert state on the tool page that files go to their servers, most with a deletion time between one hour and 48 hours. iLovePDF, iLoveIMG and PDF2Go do not say where the job runs on the page we tested.
• Session recording is common, even on local tools. Smallpdf, PDF2Go, Xodo, Soda PDF, FreeConvert, Kleap, Compresso loaded Microsoft Clarity or Hotjar, scripts that record clicks, scrolling and page content to replay a visit. Whether file names or previews are captured depends on each site’s masking settings, which we cannot see from outside.
• Other companies on the page vary widely. The tool pages contacted between 0 and 152 other companies’ domains (counted across both runs), mostly analytics and advertising. Sejda and PDF Guard contacted none.

These sites blocked our automated test browser, so they are not in the results. We did not try to get around the block:

• Adobe Acrobat online: blocked our automated test browser (Access Denied).
• Compressor.io: blocked our automated test browser (Cloudflare block page).
• SammaPix: blocked our automated test browser (challenge page).

You can check any of them yourself in a minute: see “How can I check a site myself?” below.

• Each site’s own merge or compress page, used as a visitor would: no account, no sign-in, two runs on 10 November 2026, a fresh browser profile each time, from India.
• Chrome’s network log (NetLog) recorded how many bytes every request sent and the decrypted contents, which also catches uploads made in the background that page-level tools miss.
• The test files were made for the test: two PDFs (5 and 2 pages) and one 1 MB photo, each with a random marker in its name and contents. An upload means the marker reached a server, or file-sized data went to the site’s own servers or file storage.
• “Stayed on device” means no such traffic during the whole job, and the job finished: the result downloaded, or appeared on the page when the site saves through the browser’s save dialog.
• Cookie banners: we only ever clicked “reject” or “necessary only”, never “accept”. Most sites showed no banner to a visitor from India.
• A result counts only if every run agrees, and they did for every site. As a control, our own Compress PDF, which uses a server, was run the same way and detected as an upload each time.

• An upload is not wrongdoing. Server tools can be safe, and some jobs need a server.
• We see what leaves the browser, not what a server does afterwards. Deletion times are quoted from each tool page.
• One location, one browser, one date. Sites change, and visitors elsewhere, for example in the EU, may see different consent banners and scripts.
• Analytics data that is compressed before sending cannot be searched for the marker, so session recording is reported by which script loaded, not by what it captured.
• We tested one job per site. Other tools on the same site may work differently.

The full results are free to reuse under CC BY 4.0, with a link to this page: CSV and JSON. Each row has the site, job, verdict, upload destination, timing, session-recording scripts and other domains contacted.

Related: how to check whether a PDF tool uploads your files and how Drible handles files. To see the monthly re-tests in Google, you can add Drible as a preferred source on Google.