ShyPDF
English

How to check whether an online PDF tool uploads your files

September 19, 2026

Plenty of PDF sites say “your files are safe” or “we delete everything after one hour”. You cannot check a deletion promise. You can check whether a file leaves your computer in the first place, and it takes about thirty seconds. Here is how — including where the quick test falls short, and what a stronger guarantee looks like.

The 30-second test: watch the network

  1. Open the tool in Chrome, Edge or Firefox and press F12 (on a Mac, ⌥⌘I). Choose the Network tab.
  2. Tick Preserve log and click the clear button, so the requests made while the page loaded do not distract you.
  3. Now use the tool normally: select a PDF — use an unimportant one for the test — and click merge, compress or whatever the tool does.
  4. Look at what appeared in the list.

If the tool uploads, you will see a POST or PUT request whose request size is roughly the size of your file, usually to an address containing a word like upload, task or process, followed a little later by a download of the result. Click it and open the Payload tab to see your file’s name inside.

If the tool works locally, you will see either nothing at all or a handful of GET requests for files ending in .js or .wasm. Those are the tool downloading its own code to you, not your file going out: the request is tiny and the response is large, the opposite of an upload. Also glance at the WS (WebSocket) filter, the other route a page can use to send data; it should be empty.

What this test cannot tell you

The Network tab shows what happened once, with one file, today. It cannot show that the site behaves the same way for every visitor, or that it will tomorrow. And on most websites, the page is not the only code running: analytics, advertising and chat widgets are scripts from other companies, loaded fresh on every visit, with the same access to the page — and to a file you drop into it — as the site’s own code. A local-only tool that embeds third-party scripts is making a promise on behalf of companies it does not control.

A stronger signal: the Content Security Policy

Websites can send a response header called Content-Security-Policy that tells your browser what the page is allowed to do. The browser enforces it; the page’s own code cannot switch it off. To see it, stay in the Network tab, reload, click the very first request (the page itself) and look under Response Headers.

The part that matters here is connect-src, which lists the servers the page may exchange data with. A policy containing

default-src 'self'; connect-src 'self'; form-action 'self'

means scripts on the page can only talk to the site’s own address. Requests to any other server — an analytics service, an ad network, a storage bucket — are blocked by the browser before they are sent. It also means the site cannot be quietly loading third-party scripts, because those would be blocked as well.

Many sites have no such header, or one so permissive (*, or a long list of ad and tracking domains) that it rules nothing out. That does not prove they upload your files. It does mean nothing is stopping them, or the scripts they embed.

The remaining question: can the site’s own server receive files?

connect-src 'self' still allows the page to talk to its own server, so the last thing to check is whether that server accepts uploads. For a static site — plain files on a content delivery network, with no application behind them — it does not. You can ask it directly from a terminal:

curl -i -X POST -d "test" https://shypdf.com/

A static host answers 405 Method Not Allowed: there is nothing on the other end to receive a file.

How ShyPDF does on its own test

Run all three checks on this site. The Network tab shows only downloads of code from shypdf.com. The response header is default-src 'self' with connect-src 'self', so there are no third-party scripts, no analytics and no ad networks — the browser would refuse to load them. And the server answers POST and PUT requests with 405. We would rather you verify that than take our word for it.

Quick checklist