How to Check If a PDF Tool Uploads Your Files

A browser tab tells you nothing about where your PDF goes. The page looks the same whether your file is parsed in your own memory or streamed to a server you have never heard of — same drag-and-drop box, same progress bar, same “Done” toast.

“Processed locally” is a claim, not evidence. And it is a claim worth checking, because a cloud-based PDF merger often requires you to upload the file to a server, which is convenient but creates a data-handling risk. Your contract, your invoice run, your ID scan leaves your machine, and you are trusting someone else’s retention policy, logging setup, and backup schedule.

This article is about turning that claim into something you can verify yourself, in a couple of minutes, using tools you already have. We will use RSJ PdfMerge as a concrete example of a tool that processes locally, but the method works on any browser-based PDF tool.

What Proof of Local Processing Looks Like

Before you start clicking, be clear about what you are looking for.

A tool that processes locally does the parsing, page reordering, rotation, splitting, and rendering inside your browser. The PDF bytes are read from your file picker, held in memory, and written back out as a download. No copy of the file travels over the network.

A tool that uploads does the opposite: it sends your file to a server, processes it there, and returns a result. That transfer is a network request, and network requests are observable.

So the proof is simple and falsifiable:

• Positive evidence of local processing: during the whole operation, no request carries your file’s bytes.
• Positive evidence of upload: a request whose body matches your file — same size ballpark, PDF content type, and a URL that suggests processing (/upload, /convert, /process, /v1/merge).

You do not need to trust a privacy page, a badge, or a blog post. You need the Network tab. If you want the conceptual background first — what “local” actually means and why it matters — that is the subject of What Is Local PDF Processing and Why Should You Care?, but the short version is this: local means your bytes never leave, and that is testable.

One caveat up front: proof comes from the browser’s own developer tools, an exported HAR file, or a third-party audit. Marketing copy is not proof. Neither is a lock icon.

Step-by-Step: Verify a PDF Tool in Your Browser

This procedure works on any browser-based PDF tool, including the one at https://pdfmerge.rsj.de.

1. Prepare a small test file. Use a throwaway PDF with a few pages, not the real document. It makes the size math obvious later and avoids putting anything sensitive into a session you are still evaluating.

2. Open the tool. Load https://pdfmerge.rsj.de in a normal tab.

3. Open developer tools. Press F12, or Ctrl+Shift+I on Windows/Linux, Cmd+Option+I on macOS. Switch to the Network tab.

4. Clear the log. Click the 🚫 icon (or press Ctrl+L in DevTools) so the panel is empty. Anything that appears from here on happened because of your action.

5. Do the work. Drag your test PDF in, reorder a page, rotate one, then export. If you want the split workflow in detail — pulling one document apart into several files — that is covered in How to Split a PDF into Multiple Files in Your Browser; the verification steps below are identical.

6. Watch the request list. Sort by Size and look for anything that carries a request body. A file upload is not subtle: a 2 MB PDF produces a request body of roughly 2 MB.

7. Keep the page open and disconnect. This is the cheap confirmation test. After the app has fully loaded, turn off Wi-Fi or unplug the network cable and run the merge or split again. A tool that genuinely processes locally still finishes, because there is nothing to send.

8. Export a HAR file if you need a record. Right-click anywhere in the Network panel and choose Save all as HAR with content. That gives you a session log you can search later or hand to a security reviewer.

# Search an exported HAR for anything that carries a request body.
jq -r '.log.entries[]
  | select(.request.postData != null)
  | "\(.request.method) \(.request.url) body=\(.request.postData.text // "" | length)"' pdf-tool-session.har

# Or a blunter check: any non-GET request at all.
jq -r '.log.entries[] | select(.request.method != "GET") | "\(.request.method) \(.request.url)"' pdf-tool-session.har

For a managed, no-terminal workflow, RSJ PdfMerge gives you exactly the same evidence the easy way: open the app, drag files into the thumbnail sidebar, reorder or rotate them, and export — while the Network panel sits open and stays quiet. There is no upload step to audit because there is no upload step.

Interpreting Results and Edge Cases

Not every request is a red flag. A page has to load its own furniture: HTML, scripts, stylesheets, fonts, icons. Those are normal and say nothing about your file.

Here is how a benign asset load and a file upload differ on the wire:

# Normal page furniture: a GET, no request body
GET /assets/app.bundle.js HTTP/1.1
Host: some-pdf-tool.example
Accept: */*

# Looks like an upload: non-GET, multipart body, filename in the payload
POST /api/v1/convert HTTP/1.1
Host: some-cloud-pdf-tool.example
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9xQ

------WebKitFormBoundary9xQ
Content-Disposition: form-data; name="file"; filename="lease-agreement.pdf"
Content-Type: application/pdf

Things to check when the results are ambiguous:

• Request method and body. GET requests to static assets are fine. POST or PUT requests with a body deserve a closer look at the size and the endpoint name.
• Payload size. Compare the request body size against your test file. Multipart encoding adds a little overhead, so a body that is roughly your file size — or larger — is your file.
• WebSockets and other channels. Some tools push data over a persistent connection instead of a plain POST. Filter the Network panel by WS and confirm nothing is being streamed out during processing.
• Service workers. These can intercept requests before they appear in the list. Check Application → Service Workers if a tool claims local processing but behaves oddly offline.
• Third-party calls. Analytics or error-tracking requests tell you about your visit, not your document. They are a privacy question of their own, but they are not proof of an upload.

If the log shows nothing carrying your bytes — and the operation still completes with the network off — the tool is processing locally. If you see a fat POST to /upload, you have your answer, and you should think hard about whether that document belongs there. The broader risk picture is covered in The Data-Handling Risk of Uploading PDFs to a Cloud Merger.

One more channel to consider: browser extensions. An extension can read page data in ways a website cannot, so it deserves the same scrutiny. The RSJ PDF Merge, Sort & Split Chrome extension opens the web app from https://pdfmerge.rsj.de, and the web app URL used by the extension is configurable in its options page — so you can point it at a deployment you control or verify the destination it uses. The web app itself is where the work happens, and that is the part you just audited.

How RSJ PdfMerge Keeps Processing Local

RSJ PdfMerge is a browser-based PDF tool. You can merge multiple PDFs into one document, reorder, rotate, and delete pages through the drag-and-drop thumbnail sidebar, insert custom text pages, split a document into separate files, and export the result as a single PDF or as a ZIP of individual PDFs.

The relevant part for this article: PDF files are processed entirely in the browser and are never uploaded to a server. There is no processing backend to leak, misconfigure, or retain a copy.

Practical details:

• Free tier: documents up to 100 pages.
• Paid licenses (Basic and Pro): lift the page limit and unlock ZIP features — merging ZIP archives that contain PDFs, and downloading the result as a ZIP of separate PDFs.
• Pro tier specifically: ZIP-based merging and ZIP export.
• Enterprise: white-label integration into your own website or product.

You do not have to take any of that on faith. Run the eight steps above against https://pdfmerge.rsj.de, then pull the plug and merge again. For the wider trade-off between running tools in a tab and installing software, see Browser-Based PDF Merger vs Desktop Software: Which Is Better?.

When Local Processing Matters Most

Not every PDF needs this level of care. A public brochure can go anywhere. These documents are different:

• Contracts and legal drafts that are confidential until signed.
• Financial records — payroll, invoices, bank statements, tax filings.
• Personal identification — passports, IDs, insurance documents.
• Anything under an NDA or a data-processing agreement.

Regulatory frameworks such as the GDPR may also restrict sending personal data to a third party without a lawful basis and a contract in place. An upload you did not think about is hard to document later.

PdfMerge sits between those two options. It gives you browser-based convenience without the upload step of a typical cloud merger. You do not need to install anything, and you can inspect the network behavior yourself. That combination — convenience plus verifiable locality — is the whole point.

FAQ

Can I check if a PDF tool uploads my files without technical skills?

Yes. Open your browser’s developer tools, go to the Network tab, clear it, and use the tool normally. If no request carries your file’s data, the file stayed on your device. RSJ PdfMerge is designed so that no upload occurs, and you can confirm it this way yourself. The offline test — disconnect and repeat the operation — is an even simpler version of the same check.

What if the PDF tool uses a Chrome extension?

Extensions can capture data, so it is worth checking what they do and where they point. The RSJ PDF Merge, Sort & Split Chrome extension opens the web app from https://pdfmerge.rsj.de, and the web app URL is configurable in its options page. The web app itself processes files locally, which is the part you verify with the Network tab.

Does RSJ PdfMerge upload my PDFs to a server?

No. RSJ PdfMerge processes PDF files entirely in your browser and never uploads them to a server. You can verify this by inspecting network traffic as described above, or by disconnecting from the network after the page loads and running a merge or split.

What are the page limits for RSJ PdfMerge?

The free version supports documents up to 100 pages. Paid licenses (Basic and Pro) lift the page limit and unlock additional features such as merging ZIP archives containing PDFs and downloading a ZIP of the resulting PDFs.

Conclusion

Trusting a “local processing” badge is not a security control. Watching the Network tab is. The whole check takes about two minutes, needs no special software, and gives you a straight answer: either a request carried your file, or it did not.

Do it once on a throwaway PDF per tool you use, and you will know which of them you can hand a contract to. If you want the short path, open the app, keep DevTools open, drag your files into the sidebar, and export. Try it at pdfmerge.rsj.de — free for documents up to 100 pages, with Basic and Pro licenses available when your files get bigger or you need ZIP workflows.

Related posts

• The Data-Handling Risk of Uploading PDFs to a Cloud Merger
• PDF Merge Tool Pricing: Free vs Paid Page Limits and ZIP
• PDF Merge Tool for Small Business Documents: A Practical Guide