PDF Privacy Lab — prove no-upload with DevTools

Updated 21 August 2026

How to prove, in two minutes with DevTools, that a PDF tool never uploads your document — and UnboundPDF's own dated results: zero document requests, offline completion, 124 cross-browser runs, outputs re-opened in an independent reader.

1. Open the tool you want to test (for UnboundPDF: Extract Images).
2. Open DevTools → Network. Optionally filter to Fetch/XHR.
3. Load a PDF that actually contains embedded images (text-only files prove nothing for extract).
4. Run the action (Extract images). Watch for POSTs or requests with a document body.
5. Note the date, browser, and whether a document upload occurred.

Prove it yourself in two minutes

1. Open DevTools → Network and clear the log.
2. Open Extract Images (or any UnboundPDF tool).
3. Add a PDF that contains embedded images, so the tool has real bytes to process.
4. Run the tool.
5. Read the log. Asset downloads (JavaScript, CSS, fonts) are expected. A POST, or any request whose payload is your document, would be an upload — you will not find one.

The method works on any PDF website. It is the same check we run on ourselves, and the reason this page exists: a privacy claim you can test is worth more than one you are asked to believe.

How to read the evidence

• measured an observation from a dated, repeatable test, named so you can find it.
• architecture how the product is built — true of the code, and confirmed by the measurements beside it.

Your file stays on your device

architecture There is no document-upload endpoint. Your file is read into the tab, transformed with pdf.js and pdf-lib, and written back out as a download from the same tab. No step in that path is a network call carrying your bytes.

measured Zero requests during processing. On 2026-07-23 (Cursor’s embedded Chromium, Chrome 144), a PDF with one embedded JPEG was loaded into Extract Images; the tool extracted the image (image-01-p1.jpg) and the in-page fetch/XHR log recorded 0 requests of any kind — including 0 body-bearing uploads.

measured It works with the server switched off. Our release gate (_qa/test_offline.mjs) kills the web server, puts the browser offline, reloads Merge PDF from cache and merges two real PDFs. The merge completes and the output reopens. A tool that finishes with the server dead cannot have sent your document to it.

measured Not a byte of your document is cached. The same suite also scans every cache entry on the origin for a 48-byte needle taken from the middle of each input file. None is found; every cached entry is a same-origin program asset. Caching the program is not caching your file.

architecture The only network traffic is program code: the tool's own JavaScript and CSS, and two on-demand engines — the recognition engine on first use of OCR, about 14 MB, and the segmentation model on first use of Remove Background, about 38 MB — each downloaded once from unboundpdf.com. Your scan is not part of any of those requests. Every tool on the site shares this one architecture; the offline proof above is run on Merge, and capabilities.json records per tool what has been exercised.

It holds up on large files, on every major browser engine

measured Our benchmark matrix (_qa/bench-matrix.mjs, 15 August 2026): 124 runs across Chromium, Firefox and WebKit over twelve fixtures — nothing crashed, nothing hung, and no run modified its input file. A 300-page, 119 MB scan was compressed, merged, exported to page images and opened in the editor on all three engines.

measured Problems are refused fast and by name. An encrypted document was refused in under 0.6 seconds on every engine, 9 runs of 9, with the reason stated. A file with a truncated cross-reference table — one poppler cannot open at all — was repaired and processed on all three engines, 9 of 9.

architecture Because the work happens on your device, speed follows your machine rather than a shared server queue, and there is no upload time at all — on a heavy file, skipping the round trip is itself the fastest step. Before a large job starts, the tool checks the document against your device and tells you what it found.

The file you get back is checked

measured In the same matrix, 79 of 79 output documents re-opened in poppler, a PDF stack that shares no code with the one this site ships. Page counts matched wherever the input's own count was readable, page 1 rendered to a real image every time, ZIP entry counts matched page counts, an OCR output carried 91,127 searchable characters, and a Chinese document kept all 2,988 characters through a re-save.

measured PDF/A conversion embeds every missing font, adds an sRGB output intent, removes what the standard forbids, and checks the result against our published PDF/A-2b rule list on your device before it claims conformance — 149 checks, 0 failures, in our release gate. Redact PDF verifies on the finished bytes that the redacted text is gone before it shows you a result — and says so when a page cannot be fully cleared — here is how to run that check yourself.

architecture The Workspace goes one step further: every tool run records the SHA-256 of its input and output in a Document Passport, and a verifier recomputes the whole chain against the file. It proves the recorded steps are intact and in order; it is self-issued, so it does not prove who ran them. Read how the passport works.

Scope

The Network check proves what leaves the tab, which is the question that matters for an upload-free tool. It cannot see beyond the browser: a malicious PDF exploiting a viewer, a compromised extension, or someone watching your screen are outside any website's control, ours included. Benchmarks were run on desktop engines; phones are covered by the same code but not yet by the same instruments. We publish each result with its date — re-run the method whenever you want a fresh one.

Related

Privacy · Compare · Workspace · Merge PDF · Compress PDF · PDF Editor · How UnboundPDF handles large PDFs · All guides

Frequently asked questions

Does UnboundPDF upload my PDF?

No. The tools read your file into the browser tab and write the result back out as a download; there is no upload endpoint. On the dated check below, zero requests of any kind were recorded while the tool ran, and the same suite completes a merge with the web server switched off. You can repeat the check yourself in two minutes.

How can I check that a PDF tool does not upload my file?

Open DevTools → Network, clear the log, run the tool on a real document, and look for any POST or request carrying your file. Asset downloads (JavaScript, CSS, fonts) are expected; a request with your document in it is not. The method on this page works on any PDF site, not only ours.

Is anything downloaded when I use UnboundPDF?

Only program code: the tool's own JavaScript and CSS; on first use of OCR the recognition engine (about 14 MB); and on first use of Remove Background the segmentation model (about 38 MB). Each is fetched once and then cached. Your document is not part of any request.

Can I verify the file I get back?

Yes. Reopen it in any reader — our own release gate reopens every output in poppler, an independent PDF stack. In the Workspace, every step also records the SHA-256 of its output in a Document Passport that anyone can recompute against the file.