“Your files never leave your browser”: the phrase is everywhere on Document Flare, and it deserves better than being a slogan. Here is what actually happens when you drop a PDF into a local tool — and why the upload is the risk point that user reviews put at the top of their grievances.
How local processing works
A classic online PDF tool is a form: you send the file, a server transforms it, you download the result. Document Flare inverts that architecture. When you open a tool page, the browser downloads the engine — not the document.
Concretely, three libraries do the work on your machine:
- PDF.js (Firefox’s rendering engine) draws the pages for preview and reads the document structure.
- pdf-lib manipulates the PDF’s object graph: it is what merges, splits, rotates, and adds annotations and watermarks.
- Tesseract, compiled to WebAssembly, runs optical character recognition in a separate worker so the tab stays responsive.
When you drop a file, it is read into the tab’s memory — an ArrayBuffer or a Blob, depending on the operation. The engine produces a new PDF in memory, which the browser offers you as a download. At no point is the content serialised into a network request. This is not a promise: it is verifiable. Open the Network tab in your developer tools during a merge — you will see the page-load requests, then nothing. The badge shown on our tool pages does this counting continuously and stays at zero bytes sent.
A practical consequence: after the first load, the application works offline (it is a PWA). Processing continues on a train, in a basement, or at a client site with no network — only the OCR engine needs a one-time download.
Why the upload is the real risk
The “local versus cloud” debate is often framed as paranoia. It is not: it is a question of exposure surface. As long as the file stays on your device, the only party that must be trustworthy is… your device. The moment it leaves, the chain lengthens: the server that receives it, hosting subcontractors, application logs, backups, advertised deletion windows.
We compiled 231 public reviews from iLovePDF and Smallpdf users (App Store, Trustpilot, technical forums). Two findings: the privacy of uploaded documents is the most cited objection in technical discussions — users describe watching colleagues paste confidential contracts into online tools without a second thought. And the deletion policies — “your files are erased within one to two hours” — are contractual commitments nobody can observe from the outside, not counting the technical logs (IP address, file name and size, timestamp) that outlive the document itself. We already detailed what local processing actually protects; the core point here is simple: promised deletion is a matter of trust; no upload is a matter of architecture.
Three models, honestly
The cloud (iLovePDF, Smallpdf, Acrobat online): the file goes up, the server works. Real advantages — unlimited power for large files, conversion to and from Office, signature workflows with validation, cross-device sync. Cost: the document transits through infrastructure you do not control, and heavy usage ends up behind a subscription.
The local browser (Document Flare, and self-hosted tools like Stirling PDF for technical teams): the engine comes down, the file stays. Advantages — zero upload, zero account, no commercial quota, offline operation. Honest limits: browser memory caps file size (50 MiB for us), Tesseract OCR is slower than a top-tier server engine, and nothing syncs between your devices since nothing is stored.
The desktop application (PDF24 Creator, Acrobat, Foxit): the file stays on the machine too — with the power of installed software. It is the right choice for very large volumes… if you can install software (admin rights, fixed workstation, often Windows only) and maintain an application.
No model wins everywhere. But for the everyday operation — merging a file set, compressing an attachment, rotating a scan — the question is simple: does this file need to leave your machine? If the answer is no, the upload buys you nothing.
What local does not guarantee
In the interest of honesty, two caveats. Local processing protects the journey, not your workstation: a compromised device (malware, a malicious extension) remains a compromised device. And it protects the manipulation, not the destination: once your PDF is compressed or signed, you decide where it goes — email, cloud, USB drive. Local removes one link in the chain; it does not encrypt your life.
In practice
Merge, compress or protect a PDF in Document Flare with the Network tab open: you will see for yourself that the document goes nowhere. It is the only privacy guarantee that does not rest on a third party’s promise — and the reason we have no account, no upload, and no quota to watch.
