Is your PDF converter safe? How to tell before you upload

The r/pdf thread titled "Are pdf converters safe?" gets hundreds of upvotes every time it comes up. The question is real: when you hand a PDF (an invoice, a contract, a tax document) to a random website, what happens to it?

The three things to check

1. Where does the file go?

If a tool says "we delete your files within one hour" without showing you how, that's a claim, not a guarantee. Look for:

• A public privacy policy with specific numbers (hours, not "we promptly delete")
• A published lifecycle configuration (e.g. a Cloud Storage rule you can read)
• A human-readable timeline of what happens to the file from upload to deletion

If none of these are public, assume the file lives on the server longer than they say.

2. Who can read it?

Some converters run the conversion in a shared VM where anyone with SSH access can cat the file. Others run each conversion in a fresh, ephemeral container that is destroyed afterward. The difference matters enormously.

Look for language like "isolated container" or "ephemeral worker" — and check whether anyone can opt-in to human review (a support workflow where an engineer can pull a customer's file).

3. What do they do with the data?

The worst PDF converters sell user data. The middle tier logs metadata (file size, tool used, timestamp) and keeps it for analytics. The best delete everything.

If a free tool has no obvious revenue stream, your data is the revenue stream.

How to check a PDF before you open it

Sometimes you can't vet the sender. Here's how to inspect a PDF without opening it:

1. Check for JavaScript. Legitimate PDFs almost never contain JavaScript. If a PDF has OpenAction or /JS in the catalog, that's a red flag — those run automatically on open.
2. Check for embedded files. PDFs can carry attachments in the /EmbeddedFiles tree. Many viewers let you "open" the attachment, which can launch executables.
3. Check for submit forms. A PDF with a /SubmitForm action will send your form entries to a URL when you click "submit." Legitimate forms sometimes do this; phishing forms always do.
4. Check for external links. URL annotations that reach outside the document are common but worth noting.

The DocShop PDF safety check does all four checks in your browser, without uploading the file. It reports:

• JavaScript actions (high risk)
• Embedded files (high risk)
• Submit forms (medium risk)
• External links (low risk)
• Encryption state (informational)

What "safe" means in practice

For most business use cases, "safe" means:

• The file is deleted within an hour, automatically, without human intervention
• The conversion runs in an isolated container with no shell access
• No third-party trackers on the pages where you upload
• A public privacy policy that matches the actual behavior
• The code is public or the infra is auditable

How we handle your files is DocShop's minute-by-minute timeline of what happens to your PDF from the moment you upload it to the moment it's deleted. Concrete timestamps, concrete actions, no marketing.

The uncomfortable truth

Every PDF converter has a privacy risk. The question is whether the company is honest about it and gives you tools to verify. The ones that don't have a published timeline aren't being modest — they're being evasive.

The best you can do as a user: run the safety check before uploading anything sensitive, use a converter with a public deletion policy, and avoid tools that ask for more than they need (name, company, phone number — none of that is required to convert a PDF).