You need to remove one page from a signed contract. You search "split PDF", click the first result, drag the file in, and thirty seconds later you have your document. You also just uploaded a signed contract to a company you had never heard of ninety seconds ago, whose entire business model is a mystery to you.
Almost nobody thinks about this, because the interface gives you no reason to. The upload is invisible, instant and framed as convenience.
What actually happens on most PDF sites
The classic architecture is simple, and it is what nearly every free PDF site does:
- Your file is uploaded to their server.
- The server runs a PDF library on it.
- The result is stored, temporarily, and a download link is returned to you.
Which means that for some window of time, a complete copy of your document sits on someone else's disk. And your document is not a cat picture. The files people run through these tools are exactly the sensitive ones: employment contracts, payslips, bank statements, medical letters, passport scans, tenancy agreements, invoices with client names on them.
"Files are deleted after one hour" is not a security control
Every one of these sites has that line, and it is doing a lot of unearned work.
It is a promise about a process you cannot inspect, made by a company you cannot audit, in a jurisdiction you have not checked, with a security posture you know nothing about. It says nothing about backups, nothing about logs, nothing about what happens to the file in the hour before deletion, and nothing about what happens when the company is sold or breached.
It may well be sincere. It usually is. But sincerity is not a control, and it is the wrong thing to be relying on when the file is your employment contract.
There is exactly one guarantee that survives all of those unknowns: the file never left the device. Not "was deleted." Never left.
The good news: the upload is no longer necessary
The reason these tools were built server-side in the first place is that, fifteen years ago, browsers genuinely could not do this work. That has not been true for a long time.
A modern browser can read your PDF from disk into memory, restructure its page tree, re-encode images, merge multiple documents, and write a new file back to your downloads folder — using client-side JavaScript and, where the work is heavy, WebAssembly running near-native code. The document is loaded into a tab on your own machine and never touches the network.
The trade-offs are real but small. A very large file is limited by your own machine's memory rather than a server's. Some exotic conversions still genuinely need heavier processing. But for the operations people actually perform every day — split, merge, compress, convert, reorder, rotate — the browser is entirely capable, and the file staying put is not a compromise. It is strictly better.
Why PDFvilla works this way
We built PDFvilla around that constraint from the start: the tools run in your browser, on your file, on your machine. No account, no installation, no upload queue, and nothing for us to accidentally retain — because we never receive anything.
It is also, incidentally, why it is fast. There is no upload, no queue, no download. On a slow connection, a server-based tool is bottlenecked by your upstream bandwidth twice; a local tool is bottlenecked by nothing but your laptop.
This is the same principle behind ChatLodge storing your AI knowledge base on-device. The default we keep coming back to: data should not leave the user's machine unless there is a genuine technical reason for it to. Most of the time, there is not — there is just a habit, and an architecture nobody questioned.
Split, merge, compress — without the upload.
PDFvilla runs in your browser. Free, no installation, no account, and your file never leaves your device.
Use PDFvilla →How to check any tool in thirty seconds
This works for any web tool that touches your files, not just ours:
- Open developer tools (F12) and select the Network tab.
- Run the tool on a file.
- Look for an outgoing request roughly the size of your file. If it is there, your document was uploaded.
The lazy version: disconnect from the internet and try again. If the tool still works, the processing is local. If it fails, your file was going somewhere — and now you know where you stand before you feed it the contract.