Key takeaways
- Most free online PDF tools, including iLovePDF and Smallpdf, upload your file to a server to process it — even for simple tasks like merging.
- 'Processed locally' means the work happens in your browser's own memory, using JavaScript libraries like pdf-lib and pdf.js — the file itself never travels over the network.
- This matters most for sensitive documents: signed contracts, medical paperwork, financial statements, anything under an NDA.
- You can check this yourself: open your browser's Network tab while using a tool — if the file doesn't appear in an outgoing request, it wasn't uploaded.
What 'runs in your browser' actually means
When people hear a PDF tool is 'free and online,' the quiet assumption is usually that the file gets sent somewhere to be processed and a result comes back. For most tools, including the well-known ones, that assumption is correct.
Toolkitties' tools are built the other way around: the PDF library (pdf-lib for editing, pdf.js for reading) runs as JavaScript inside the page you already have open. Your file is read into the browser's memory, worked on there, and the result is handed back to you — there's no step where it leaves your device.
Tools worth using this way
The tools where this matters most are the ones people hesitate over before uploading anywhere:
- [Protect PDF](/protect-pdf) — password-lock a contract or statement without handing the unlocked version to a server first.
- [eSign PDF](/esign-pdf) — draw and place a signature on a document locally; the signed file is never stored on anyone else's servers.
- [Merge PDF](/merge-pdf) and [Compress PDF](/compress-pdf) — the most common everyday tasks, done without an upload step.
- [AI PDF Chat](/ai-pdf-chat) — summarizing or asking questions about a document using a small AI model that downloads once and then runs entirely offline, instead of sending your document's text to a cloud AI API.
Frequently asked questions
Is a server-based tool automatically unsafe?
Not automatically — reputable companies like iLovePDF and Smallpdf use encryption in transit and typically delete files after a short retention window. But 'processed locally' removes the question entirely: there's no server copy to encrypt, retain, or eventually delete, because it never existed.
Does this apply to every Toolkitties tool?
Yes — it's a design choice for the whole site, not a feature of one tool. Every tool listed on the all-tools page runs client-side.