Which free PDF mergers upload your file? We measured five

We merged the same two PDFs on iLovePDF, Smallpdf, PDF24, Sejda and MostlyPDF and counted the bytes. Four uploaded the file. Here's how to check any tool.

Max Čelar·October 12, 2026·Private PDF

What’s new here: A dated network measurement of five free online PDF mergers — which send your file to a server and which merge it in the browser — from a published Playwright harness that counts the bytes each tool sends per host, run on 12 October 2026 with two generated test PDFs (609,522 bytes), plus an offline test in which every tool, ours included, failed.

Of the five free online PDF mergers we tested, four sent the whole file to their servers and one merged it in the browser. We merged the same two PDFs on each tool and counted every byte the browser sent. iLovePDF, Smallpdf, PDF24 and Sejda each sent between 615 and 624 KB of a 610 KB input to their own servers — the file, plus a little overhead. MostlyPDF (ours) sent less than 1 KB, none of it the file. You can check any tool yourself in 30 seconds; the method is below.

Uploading isn’t automatically unsafe. All four vendors say they delete files after an hour or two, and there’s no reason to doubt them. But “we delete it later” and “we never had it” are different promises. If the PDF is a contract, a payslip or a passport scan, the difference is yours to choose — so it’s worth knowing which one you’re getting.

# What each tool did with the file

Measured 2026-10-12, Chromium 148.0.7778.96 (Playwright, headless).

The table is generated from the published dataset by the harness itself (--table), not typed by hand. What each vendor says it does with the file, read on the same day from its own page:

• iLovePDF: files are kept “for a maximum of 2 hours so you can download them”.
• Smallpdf: files are “automatically deleted from our servers after one hour”.
• PDF24: files are “automatically deleted from the PDF24 server after one hour”.
• Sejda: files are “automatically deleted after 2 hours”.
• MostlyPDF: merge, split, rotate, organize, page numbers, watermark, crop, form filling and image to PDF run in the browser. Our conversion tools do upload; those files are deleted within 24 hours.

# How we measured it

The harness, merge-upload-check.js, opens each tool’s public merge page in a fresh headless Chromium and runs two passes.

The online pass attaches the same two PDFs, presses Merge, and waits for the result. The browser runs behind a small proxy, inside the harness, that counts the bytes sent to each host — every encrypted connection, whatever the page uses to send it. A tool counts as having uploaded the file when one host received at least half the size of the input.

The offline pass opens the page, then cuts the network before the files are attached, and tries the same merge. A tool that truly works in the browser should still produce the file.

The inputs are generated by the harness, so nothing real is sent anywhere and their size is exact: a 3-page A4 text PDF (10,065 bytes) and a 2-page PDF carrying a 598,099-byte JPEG of random noise (599,457 bytes). Noise doesn’t compress, so an upload can’t hide by shrinking.

Four things the measurement doesn’t cover, stated here rather than in a footnote:

• One date, one browser, the free web flow only. No desktop apps, no paid tiers, no mobile apps. Vendors change their flows; the table carries its date and the harness to re-run it.
• PDF24 sends the file when you attach it, before you press Merge — the bytes were counted every run. Its result screen (“PDF24 has merged 2 files into a single PDF”) showed in our screenshots, but the harness never registered it, so its offline result is marked “not measured” rather than guessed.
• Uploading is not the same as unsafe. The table says where the file went, not what happened to it afterwards. For that, the vendors’ own retention statements are quoted above.
• We built one of the five tools. That’s why the harness and the dataset are public: if a number here is wrong, you can show us.

# Our own tool failed the offline test

MostlyPDF didn’t send the file anywhere, but it didn’t merge offline either. When we cut the network, it showed its “Process on our servers instead?” dialog.

The cause was mundane. The merge engine was only downloaded the first time you pressed Merge, so with the network already off it couldn’t load, and the tool fell back to asking permission to use the server. It asked first — nothing was uploaded without a yes — but “works in your browser” should mean it works after the page has loaded, whatever the network does next. We changed it so the engine loads when the tool opens. The table above is the measurement before that change, and we’ll re-run the harness once it’s live and update this page.

# Check any PDF tool yourself in 30 seconds

You don’t need our harness to see this. In Chrome, Edge or Firefox:

1. Open the tool’s page, then open the developer tools (F12, or ⌥⌘I on a Mac) and choose the Network tab.
2. Add your PDF and run the tool.
3. Sort the list by Size (or look at the “transferred” total at the bottom). A request about as large as your PDF going to the vendor’s domain is your file being uploaded.

There’s an even simpler check: load the page, turn on airplane mode, then run the tool. A tool that really works in the browser still produces the file — once its code has loaded, which is exactly what tripped us up above.

# Why merging can stay local, and compressing usually can’t

Merging, splitting, reordering, rotating, numbering and watermarking change a PDF’s structure: which pages are in it, in what order, with what drawn on top. A JavaScript library like pdf-lib can do all of that in the browser, and that’s what our in-browser Merge PDF and Split PDF tools run on.

Shrinking a PDF well, or turning it into Word, is different work. It needs engines like Ghostscript and LibreOffice, which don’t run in a browser at useful quality. That’s why our own Compress PDF uploads the file — and says so on the page — like everyone else’s.

# When you need fully offline

If a document must never touch a network at all, use a desktop app: Preview on a Mac merges PDFs by dragging page thumbnails between documents, and PDFsam Basic is a free, open-source merger for Windows, macOS and Linux. And if you live in Chrome, our extension opens any PDF straight into the same in-browser tools.