PDF Privacy Lab — prove no-upload with DevTools
A repeatable Network-tab method to check whether a PDF tool uploads your document — plus UnboundPDF’s dated result, threat model, and honest limits.
- Open the tool you want to test (for UnboundPDF: Extract Images).
- Open DevTools → Network. Optionally filter to Fetch/XHR.
- Load a PDF that actually contains embedded images (text-only files prove nothing for extract).
- Run the action (Extract images). Watch for POSTs or requests with a document body.
- Note the date, browser, and whether a document upload occurred.
Last tested: 2026-07-23. UnboundPDF Extract Images processed a PDF with an embedded image and returned 1 embedded image extracted with no document POST observed in a fetch/XHR hook. Re-test before trusting any later claim.
What “local browser processing” means
Your PDF is read and transformed in the tab using your device’s CPU and RAM. UnboundPDF is built so there is no document-upload API for the core tools. That is a mechanism claim — verify it, don’t take a slogan.
Threat model
Protects against (when the Network check holds): a random upload site receiving a copy of your file for merge/extract/compress.
Does not protect against: a malicious PDF exploiting the viewer; a compromised browser extension; screen sharing; shoulder surfing; or standard CDN/server access logs that record that you requested the tool page (IP + URL) — those logs do not contain your file bytes if the file never left the tab.
Method anyone can repeat
- Open DevTools → Network.
- Open Extract Images (or another UnboundPDF tool).
- Add a PDF that contains embedded images. Text-only samples are the wrong fixture for extract proof.
- Clear the Network log, then run the tool action.
- Look for POSTs or requests whose payload is your document. Asset GETs (JS, CSS, fonts, public samples) are expected; a document upload is not.
Dated UnboundPDF result
On 2026-07-23, in Cursor’s Chromium shell (Chrome/144), a 2756-byte fixture PDF with one embedded JPEG was loaded into Extract Images. The UI reported 1 embedded image extracted (image-01-p1.jpg). During Extract, the in-page fetch/XHR log recorded 0 requests — including 0 body-bearing uploads. Evidence: internal Privacy Lab network note (same date).
Honest limits
- OCR first use: the recognition engine (about 24 MB per live tool FAQ) downloads once as program code from UnboundPDF, then runs on-device — your scan bytes stay local.
- Device limits: huge files are bounded by your RAM/CPU, not a cloud queue.
- Outside the tab: this method cannot prove what a compromised OS does with memory dumps.
FAQ
Does UnboundPDF upload my PDF?
On the 2026-07-23 check above: no document POST during Extract. Re-run the Network method after any product change.
Why must the test PDF contain images?
Otherwise you only prove the empty-result path. Image bytes in → image bytes out is the processing proof.
What does local processing not protect against?
Malicious PDFs, spyware extensions, and visual exposure of your screen.
Where is the policy write-up?
See Privacy and the mechanism table on Compare.
Related
Privacy · Compare · Merge PDF · Compress PDF · PDF Editor · All guides