Check it yourself

We say your files are never uploaded. You don’t have to take our word for it: here are three ways to check, in a couple of minutes, with nothing to install.

Try it here, with any file

Choose any file at all. This page reads it on your device and works out its SHA-256 fingerprint, the same kind of work the tools do: open the file and process it in the browser’s memory. Below, you’ll see live how many network requests the page makes after you choose it.

If you like, compare the fingerprint with your computer’s own: on Windows, certutil -hashfile file SHA256; on macOS or Linux, shasum -a 256 file. If they match, the page read the whole file without sending it anywhere.

Test 1: airplane mode

1. Open any tool, such as Merge PDF, and let it load.
2. Go offline: turn on airplane mode or switch off Wi-Fi. The “Connection” indicator on this page changes to “Offline”.
3. Use the tool with your files. It works the same and downloads the result, because it doesn’t need to send anything.

The HEIC tool (iPhone photos) downloads its photo reader the first time you choose a photo; to test it offline, open one photo before you disconnect.

Test 2: your browser’s Network tab

Browsers list every request a page makes. This works on a desktop computer:

1. Chrome or Edge: press F12 (or Ctrl + Shift + I) and open the Network tab. Firefox: Ctrl + Shift + E. Safari: first turn on the Develop menu under Settings › Advanced, then Option + Cmd + I and the Network tab.
2. With that tab open, use a tool with a large file.
3. Look at the list: the page’s own code loads and, at most, the visit counter. No request is the size of your file, and there’s no upload (POST) carrying it.

Test 3: the rule your browser enforces

Every aurapdf page arrives with a security rule (a Content Security Policy) that tells your browser which addresses the page may connect to. The browser enforces it on its own: even if we wanted to, the page couldn’t send data anywhere else. This is the rule your browser just received, read live:

The key part is connect-src: the only addresses the page can send anything to. There are three, and here’s what each one is for:

• aurapdf.com ('self'): the site itself. The tools’ code is downloaded from it. The only thing ever sent to it is the contact form, when you write to us.
• cloudflareinsights.com: Cloudflare Web Analytics, our visit counter. It gets the page address and how long it took to load; it uses no cookies and never gets your files.
• challenges.cloudflare.com: the anti-bot check on the contact form. It’s only used on that page.

Images can’t come from other sites either (img-src 'self' data: blob:), which closes another well-known way of getting data out of a page.

What this can’t prove

• Your browser extensions can read any page you open, ours included. For sensitive documents, use a window without extensions (for example, a private window where they’re turned off).
• What you do with the result afterwards: if you attach it to an email or put it in a cloud drive, it travels there.
• What the file already carries: not uploading it doesn’t strip the details inside it (the author, earlier versions, photo GPS). To see and remove them before you send it, use What’s hidden in your PDF.