What Happens to Your Files When You Use an Online Converter?
With most online converters, your file is uploaded to the company's server, converted there, and stored for a while so you can download the result. Reputable services delete it after a set period, often stated in hours, and explain this in their privacy policy. Some tools work differently and never upload the file at all: the conversion runs inside your own browser.
Neither type is automatically unsafe. The point is knowing which kind you're using, so you can decide what's fine to put through it. A holiday photo is a different matter from a passport scan or a signed contract.
The usual journey of an uploaded file
For a server-based converter, the steps generally look like this:
- Upload. Your browser sends the file over the internet to the service. If the site uses HTTPS (the padlock in the address bar), the transfer is encrypted, so others on your network can't read it in transit.
- Processing. The file is saved on the service's server, or a cloud provider it rents from, and a program converts it.
- Storage for download. The converted file, and often the original, stay on the server until you download them, and usually for some time after.
- Deletion. The service removes the files after its stated retention period, or when you click a delete button if it offers one.
Along the way, the service may also keep logs: your IP address, the file name, its size and the time. Logs are normal for running a website, but a file name like passport-john-smith.pdf already says something about you.
What to look for in the privacy policy and terms
You don't need to read every line. Search the page (Ctrl+F or Cmd+F) for these words:
- "delete" or "retention": how long files are kept. A clear, specific period is a good sign. Vague wording such as "for as long as necessary" tells you less.
- "third party" or "processor": who else handles your files, such as cloud hosting or conversion partners.
- "licence" or "license": whether the terms give the company rights to use your content. For a converter, there should be no reason to claim anything beyond what's needed to perform the conversion.
- "train" or "improve": whether uploaded files may be used to improve their services or train AI models.
- Where the company is based: this affects which privacy laws apply to your data.
If you can't find a privacy policy at all, or the site is covered in pop-ups and fake download buttons, treat it as a site for nothing personal.
How to spot a tool that works in your browser
Modern browsers can read and process a file you pick without sending it anywhere. The browser's FileReader feature, for example, lets a web page read the contents of a file you've explicitly selected, and only that file. Image editing, PDF merging and many conversions can happen entirely on your device this way.
Signs that a tool runs locally:
- It says so clearly, for example "files are processed in your browser and never uploaded".
- There's no upload progress bar. Processing starts instantly, even for a big file, because nothing travels over the internet.
- It still works offline. Load the page, turn off Wi-Fi or mobile data, then try converting a file. If it works, the conversion is happening on your device. (Some tools download extra components on first use, so try it once online first.)
For a more precise check, you can watch the traffic yourself. In Chrome or Edge, press F12 (or Cmd+Option+I on a Mac) to open developer tools, click the Network tab, and then use the tool. A server-based converter will show a request about the size of your file being sent. A local tool won't.
All the tools on KhanTools work this way. PDF Merge and PDF Sign use the pdf-lib library in your browser, and Image Compress uses your browser's built-in image encoder; your files aren't sent to our server. Background Remover downloads its AI model files to your device on first use, but your photo itself isn't uploaded. You can use the offline or Network tab check on them too.
Matching the tool to the file
A simple way to decide:
| Type of file | Examples | Reasonable choice |
|---|
| Nothing personal | Public images, a blog graphic, a recipe PDF | Any reputable converter |
| Somewhat personal | Family photos, a CV, a school form | A service with a clear deletion policy, or a browser-based tool |
| Sensitive | ID or passport scans, bank statements, payslips, medical letters, signed contracts | A browser-based tool or software installed on your own device |
| Confidential work files | Client documents, unreleased plans | Whatever your employer approves; check before using any outside service |
Your computer may already have what you need. Most PDF readers can export pages, phones can save photos in different formats, and office programs can save as PDF. For a sensitive file, built-in software is often the simplest answer.
If you've already uploaded something sensitive
There's usually no need to panic. Check whether the service has a delete button on the download page and use it. Look up its retention period in the privacy policy. If you're in a region with data protection laws, such as the UK or EU, you can ask the company to delete your data, and its privacy policy should say how to contact it.
For next time: if the file is something you wouldn't email to a stranger, use a tool that keeps it on your own device.
KhanTools — Free Online Web Tools
Free browser-based tools for images and PDFs. No uploads. 100% private.
Blog ·
About ·
Privacy Policy ·
Terms of Service ·
Contact
JavaScript is required to use KhanTools. Please enable JavaScript in your browser.