Most online PDF tools work like this: they upload your file to their servers, process it there, and hand back the result. But for documents like contracts, IDs and invoices, that means a copy of your file ends up on a server you don't control. For most structural PDF operations, that's unnecessary.
What does "on-device" mean?
On-device (client-side) processing means the whole job happens inside your browser — the file is never sent to the internet. That means three things: privacy (the file stays with you), speed (no upload/download wait, instant result) and the ability to work offline.
Tools that run in your browser
- Merge, Split, Rotate, Delete Pages, Reorder Pages — all on your device.
- Images to PDF, signing and annotating a PDF — on your device.
- Document Scanner — including the camera image, entirely on your device.
Merge On-Device — Merge your PDFs in your browser, without uploading to a server.
So does every tool run on-device?
Let's be honest: no. Heavy jobs like Word/Excel conversion, OCR and compression run on the server (they aren't practical in the browser). With AI tools, your file isn't uploaded — the text is extracted on your device and only the text is processed. So it's always clear which tool runs where.
For the most sensitive documents (IDs, contracts, health records), prefer the on-device structural tools and the document scanner; and if needed before sharing, remove sensitive data with real redaction.
Redact Sensitive Data — Permanently remove personal data before sharing.
How to tell whether a tool really runs on your device
A privacy claim means something when it can be tested. The simplest way to find out whether a tool uploads your file is to try the operation with your connection switched off. If it completes, the file never left your device, because there was nothing to send. That thirty-second test gives a more definite answer than reading any site's privacy page.
What «files are deleted after an hour» really means
That is the privacy promise of most online tools, and it is an honest one — but it misses the point of concern. Until deletion the file sat on a server, crossed the network on its way there, and was visible to anyone with access to that system during the window. With a tool that runs on your device, no copy to delete is ever created. The difference is not the quality of the deletion policy but the fact that the file never travelled.
Why some jobs need a server
That not every tool runs locally is a matter of the work's nature rather than a choice. Rearranging, merging, rotating or deleting pages changes the document's structure, which a browser handles comfortably. Word conversion, OCR, compression and AI processing need serious computing power and large components; downloading those into every visitor's browser would be neither fast nor realistic.
A practical distinction for your own documents
- Identity, medical, financial and legal documents: do everything you can on your device.
- If a document with personal data must be processed on a server, remove what is not needed first.
- For internal or already-public documents, the distinction matters little in practice.
- When unsure, ask whether it would trouble you if the document got out — if not, server processing is fine.
Where privacy alone is not enough
A file not being uploaded does not mean the document is safe. When the work is done, the document sits on your device, and one left in the downloads folder of a shared computer is a bigger risk than a server ever was. After working with sensitive documents, deleting intermediate copies and clearing metadata before sharing is the companion to processing locally.