Topic
PDF Privacy: What Leaves Your Device and What the File Reveals
By Happy Turtle Tech ยท Published
PDF privacy is two questions people often run together. The first is about the tool: does your file leave your device while you work on it? The second is about the file: what does it reveal to whoever receives it? A tool that never uploads anything can still hand you a file full of properties and comments, and a spotless file can still have been uploaded to a stranger's server on the way.
This page takes the two in turn and then covers the tools that deal with the file itself.
1. Does the tool upload your file?
You can check this for any tool, ours included. Open your browser's developer tools, go to the Network tab, pick a file in the tool and run the operation. A tool that uploads will send a request, usually a POST or a PUT, whose size is close to the size of your file, to its own servers or to a storage service.
HerePDF does the work in the page, so no such request appears. Our own test suite checks it: it records every request while Merge, Redact and Extract Text run on a document with a unique name and text, and fails on anything that is not a plain page fetch from this site, apart from the anonymous page-view counters described in the privacy policy.
2. What the file says about you
A PDF records who made it and with what: author, title, the program and its version, creation and modification dates, and sometimes the path or username of the machine. Photos inside it can carry the camera model and the GPS position where they were taken. The Metadata tool shows all of it, lets you edit or clear it, and can strip the camera and location data from embedded photos.
3. What is hidden inside the file
Beyond the properties, a file can hold attached files, scripts, comments and markup, and copies of earlier properties. Remove Hidden Data lists them first and then removes what you choose, pruning the objects so the bytes are gone from the saved file. It says what it does not remove, and the checklist guide covers the rest by hand.
4. Hiding text so it stays hidden
Covering text with a shape does not remove it. Redact renders the pages you mark to pictures with the black baked in, rebuilds those pages, and prunes the originals out of the saved file, so the text is gone from the file and not only from view. Marks are drawn on your screen and applied in your browser; nothing is sent for processing.
5. Passwords, and what they do not do
Password Protect adds an open password with AES-256, so the file cannot be read without it. Because the file's internal structure is encrypted too, page count and font names are hidden as well as text; the file size and the encryption details remain visible. A short password is the weak point, not the cipher, which is why the tool warns about passwords under 12 characters.
It cannot open a file whose password you do not know. If you do know it, you can unlock the file as you open it in any tool here.
6. Signatures and watermarks are marks, not locks
A signature drawn with Sign and a watermark added with Watermark are drawn into the page like any other content. They show something to a reader; they do not prove who signed and they do not stop anyone copying or editing the file. The tools say so, and the guides explain what each is good for.
For a file you are about to send, the cleaning route in the first topic puts these steps in order.