Are online PDF scanners safe? What actually happens to your files

You search “scan to PDF online”, land on a friendly site, and feed it a photo of your passport. Pause: where did that photo just go? For most converter sites the honest answer is to our servers — and everything after that depends on their policies, security and business model.

The two architectures

	Server-side tools	On-device tools
Where processing happens	Their computers	Your browser
Who technically holds a copy	They do, at least briefly	Only you
What protects you	Their policy + security + retention promises	Physics — the file never leaves
Works offline	No	Yes (a strong tell!)

Server-side isn't automatically evil — reputable services exist. But for identity and financial documents, every server hop is surface area: retention bugs, breach exposure, staff access, subpoenas, “we use content to improve our services” clauses.

Questions that separate the good from the sketchy

• Does the privacy policy say files are processed locally — or “deleted after X hours” (which confirms they were uploaded)?
• Is there a business model you can see (and is it you)? Ads next to an ID-card uploader are a smell.
• Does the tool work offline? Only genuine on-device tools do.
• HTTPS is table stakes — it protects transport, not what the server does after arrival.

Where ToPDF sits

ToPDF is built on-device by design: the scanning engine downloads to your browser once, and every step — edge detection, cropping, enhancement, naming, PDF assembly — executes on your hardware. There is no upload endpoint to worry about, which you can verify in two minutes: here's how.

Frequently asked questions

Is HTTPS enough to make a scanner safe?

HTTPS protects the trip, not the destination. A server-side scanner with perfect HTTPS still ends up holding your document; safety then depends entirely on what they do with it.

Are “files deleted after 1 hour” promises trustworthy?

They confirm uploading happens and ask you to trust deletion. Even honest implementations leave logs, caches and backups. On-device tools make the promise unnecessary.

What about scanner apps from big companies?

Big names are usually competent on security, but many still route documents through cloud OCR by default and tie scans to your account. Read the specific product’s data handling — “big” and “local” are different properties.