How to Merge PDFs Without Uploading Them to a Stranger's Server

Type "merge PDF" into Google and you'll get dozens of free online tools. Most of them work the same way: you upload your PDFs, their server merges them, and you download the result. What could go wrong?

Quite a lot, as it turns out. In this article, we'll explain the privacy risks of server-based PDF tools and show you how to merge PDFs entirely in your browser — no uploads required.

What happens when you upload a PDF

When you use a typical "free" online PDF tool, your document travels across the internet to a server you don't control. That server may be:

Located in another country with different privacy laws
Operated by a third party you've never heard of
Logging your IP address and document metadata
Storing a copy of your file for "quality assurance" or training data
Sharing data with advertising partners or analytics providers

You have no way to verify what happens to your file after upload. The site's privacy policy may promise deletion, but you can't audit the server to confirm. And if the site is breached (as many free tool sites have been), your document could end up in the wild.

Why this matters

PDFs are often used for sensitive documents: contracts, tax forms, medical records, bank statements, legal correspondence. Merging two PDFs into one might combine an offer letter with a signed contract — exactly the kind of data you don't want sitting on a stranger's server.

Even seemingly innocuous documents can leak information:

Metadata: PDFs store author names, creation dates, software used, and sometimes even GPS coordinates from scanned documents
Hidden layers: Some PDFs contain redacted text that's still present in the file structure
Comments and annotations: Reviewer comments may be visible in the merged file even if not displayed
File names: A filename like "acme_corp_nda_2025.pdf" tells the server you're working on an NDA for a specific company

The client-side alternative

Modern browsers can do everything a PDF merge server does, without uploading anything. The technology stack:

pdf-lib: A JavaScript library that can create, modify, and save PDF documents entirely in the browser
FileReader API: Reads files from disk into memory
Blob API: Lets the browser offer the result as a download

The flow is:

You select PDFs using a file input or drag-and-drop
The browser reads each file into memory (ArrayBuffer)
pdf-lib copies pages from each source PDF into a new combined PDF
The result is offered as a download via a Blob URL

At no point does any file leave your device. The "server" in this architecture is just a static website serving JavaScript — it never sees your files.

How to verify a tool is truly client-side

Not every tool that claims "private" or "secure" actually is. Here's how to verify:

Check the network tab

Open your browser's developer tools (F12) and switch to the Network tab. Use the tool to process a file. You should see:

The initial page load (HTML, CSS, JS)
Possibly some analytics or ad requests
No request containing your file

If you see a POST request with a large payload to an API endpoint, your file is being uploaded.

Check the source code

If the tool is open source, look for fetch() or XMLHttpRequest calls that include the file. A truly client-side tool will use FileReader, arrayBuffer(), and Blob — all of which operate locally.

Look for specific claims

Vague claims like "your privacy matters" are meaningless. Look for specific technical claims:

"All processing happens in your browser"
"Files never leave your device"
"No server-side processing"

Even better if the tool explains how it works and links to the libraries used.

Merging PDFs client-side with Convaduit

Our Merge PDF tool is built on this principle. Here's how to use it:

Drag and drop two or more PDF files into the upload area
Reorder them by dragging the arrow buttons (the order determines the page order in the result)
Click "Merge PDFs"
Download the combined file

The entire process happens locally. The only network request after the page loads is for ads (which is how we keep the tool free).

Other client-side PDF operations

The same client-side approach works for most common PDF operations:

Split PDF: Extract specific page ranges from a PDF
Compress PDF: Rasterize pages to reduce file size
Image to PDF: Combine images into a single PDF
PDF to Word: Extract text from a PDF

All of these can run entirely in the browser using libraries like pdf-lib, pdfjs-dist (Mozilla's PDF.js), and the Canvas API.

The bottom line

When you upload a PDF to a "free" online tool, you're trading your privacy for convenience. For sensitive documents — contracts, financial statements, medical records — that trade is rarely worth it.

Modern browsers can handle most PDF operations locally, and tools that respect your privacy are increasingly available. Next time you need to merge, split, or compress a PDF, look for a tool that promises — and verifies — that your files never leave your device.