Is PDFMerge Safe? A Look at Local Processing and Privacy

Before you feed a PDF containing contracts, tax forms, or client data into a web tool, “Is PDFMerge safe?” is the right question. Many browser-based PDF utilities ask you to upload files to a server. PDFMerge makes a more specific claim: it processes PDFs entirely in your browser. That claim matters, but it should also be verifiable. This article shows you how to check it yourself.

Why Verifying PDF Tool Safety Matters

A cloud-based PDF merger often requires you to upload the file to a server, which is convenient but creates a data-handling risk. If that server is misconfigured, breached, or retains files longer than expected, documents you intended to keep private can end up somewhere you never approved.

Local processing removes the upload step. Instead of sending the PDF to a remote conversion service, the browser does the merge, sort, split, or page removal on your device. That means the file never has to leave your computer.

But a privacy page is not the same as proof. If you deal with sensitive documents regularly, a quick verification habit is worth more than trusting a badge. If you need the conceptual background first, see What Is Local PDF Processing and Why Should You Care?.

What Proof of Local Processing Looks Like

For a browser-based PDF tool, local processing is observable. Proof looks like:

• No network requests that carry your PDF content during a merge or split.
• No upload endpoint activity in the browser’s Network tab.
• Static page assets such as HTML, JavaScript, CSS, and fonts load once, but file operations do not trigger a server round trip.
• The tool continues to work after the page has loaded and the network connection is disabled.
• The behavior is inspectable with standard browser developer tools.

PDFMerge’s web app is accessible at https://pdfmerge.rsj.de, so anyone can open the Network tab and watch what happens during an operation.

Step-by-Step: Verifying PDFMerge’s Local Processing

1. Open https://pdfmerge.rsj.de in a desktop browser.
2. Prepare a small test PDF with non-sensitive content. This is not a full security audit—just a repeatable check.
3. Open Developer Tools. In most browsers, press F12, or use Ctrl+Shift+I on Windows/Linux or Cmd+Option+I on macOS.
4. Go to the Network tab. Keep the Developer Tools panel open.
5. Perform a merge or split operation. Drag in two test PDFs, reorder or remove a page, then run the action. If you want a dedicated walkthrough of splitting, see How to Split a PDF into Multiple Files in Your Browser.
6. In the Network tab, filter to Fetch/XHR. You should not see a request that uploads your PDF content to an external endpoint. Occasional requests for static assets can appear, but the PDF data itself should not leave the page.
7. Optional offline check: once the page has loaded, switch the Network tab to Offline or disconnect from the internet. Run the merge or split again. The operation should still complete.

You can also run a small console check to list the unique hosts contacted during the page session:

// After loading PDFMerge and running a merge or split,
// list the unique hostnames contacted during this page session.
[...performance.getEntriesByType("resource")]
  .map((entry) => new URL(entry.name).hostname)
  .filter((host, index, arr) => arr.indexOf(host) === index);

The expected output is short. You should see pdfmerge.rsj.de and possibly static asset domains. A long list of unknown third-party upload endpoints would be a reason to dig deeper.

Interpreting Results and Edge Cases

An absence of upload requests is the main indicator of local processing. If the file were being processed on a server, the browser would need to send the PDF somewhere. A local merge simply manipulates the file already loaded in memory.

Initial page load is not the same as file upload. The page itself, its scripts, and its styles must be fetched from the server when you first open the tool. That is normal. The privacy question is about what happens after the page is ready and you run a merge, sort, or split.

The offline test is useful because it removes ambiguity. If a tool depends on a remote server for the actual PDF work, disconnecting the network should break it. If the operation still succeeds, the heavy lifting is happening on your device.

The Chrome extension is an edge case worth understanding. The extension opens RSJ PDF Merge, Sort & Split from https://pdfmerge.rsj.de, so the same local processing behavior applies in the browser session. The extension does not add a server-side processing step.

Free and Pro tiers also behave the same way from a privacy standpoint. The free version supports documents up to 100 pages. Paid licenses lift page limits, and Pro adds ZIP-related features such as merging ZIP archives containing PDFs and downloading the result as a ZIP of individual PDFs. None of those tiers changes where the PDF is processed: it stays in your browser.

How PDFMerge Compares to Other PDF Tools

PdfMerge sits between those two options. It gives you browser-based convenience without the upload step of a typical cloud merger. You do not need to install anything, and you can inspect the network behavior yourself.

A desktop PDF suite may also process documents locally, but it brings installation, updates, and operating-system friction. A cloud merger may be convenient, but it requires you to trust the server with every document you feed it. PDFMerge’s approach is browser-based without the upload step.

For a deeper comparison of browser-based and desktop workflows, see the article Browser-Based PDF Merger vs Desktop Software: Which Is Better?.

FAQ

Does PDFMerge upload my PDF files to a server?

No. PDFMerge processes all PDFs entirely in your browser. You can verify this by opening the Network tab in your browser’s developer tools while using the tool—no upload requests will appear.

How can I be sure PDFMerge doesn’t send my data anywhere?

You can inspect network traffic during a merge or split operation. Since the tool works even after you disconnect from the internet once the page is loaded, it proves files never leave your device.

Is the PDFMerge Chrome extension safe to use?

Yes. The extension opens RSJ PDF Merge, Sort & Split from https://pdfmerge.rsj.de, which processes files locally. The extension itself does not handle file data beyond passing it to the web app in your browser.

Does the free version of PDFMerge have the same privacy protections as Pro?

Yes. Both free and Pro versions process files locally. The only differences are page limits and ZIP features; privacy is identical.

Conclusion

“Is PDFMerge safe?” is best answered by watching what the tool actually does. Open the Network tab, run a merge or split, and check whether your PDF leaves the browser. In PDFMerge’s case, the operation is designed to stay local, and the free tier is enough to test that behavior with a non-sensitive document.

The next step is practical: try PDFMerge with a small test PDF, run the verification steps above, and see whether the workflow fits your document handling. If you later need ZIP-in/ZIP-out features, the Pro tier is there—but it does not change the privacy model.

Related posts

• How to Verify a PDF Tool Does Not Upload Your Files
• How to Sort PDF Pages Online: A Quick Guide
• How to Merge ZIP Files Containing PDFs