Are free online file converters safe? How to check before you upload

You need a PDF turned into a Word file, and you need it in the next five minutes. So you search "pdf to word", click whatever's at the top, drag the file in, and download the result. It works. You close the tab and forget about it.

The file was your tax return. Or a passport scan, or a client contract. It's now been on a server run by people you've never heard of, and you've no idea whether it's still there.

Usually nothing bad happens. But whether free online file converters are safe has a more useful answer than yes or no. It comes down to two things: whether the site is honest, and whether your file ever leaves your computer.

Quick answer: A reputable converter that deletes uploads within an hour or two is fine for everyday files. The real dangers are fake converter sites, often reached through ads, that push downloads or browser extensions, and sensitive documents sitting on servers you can't check. For anything private, use a converter that processes files in your browser and never uploads them. You can test that in under a minute.

What the FBI actually warned about

In March 2025 the FBI's Denver field office put out a warning about free online file converters. Not a vague "be careful online" notice, either. It described sites that do the conversion you asked for and quietly load malware onto your machine while they're at it.

Malwarebytes' write-up of the warning is the clearest summary. The most common bait was Word to PDF and PDF to Word, followed by tools that merge several images into one PDF. The malware could lead to ransomware, and it went after exactly what you'd fear: Social Security numbers, banking logins, crypto wallets, saved passwords and session tokens, which can let an attacker skip past two-factor authentication.

The nasty part is that the conversion usually worked. You got your file, it looked right, and you had no reason to think twice.

It hasn't gone away. Security researchers kept reporting fake converters through 2025 and into 2026, a lot of them reached through paid search ads for phrases like "Word to PDF converter". The ad sits above the genuine results, looks professional, and costs the attacker very little.

Two different ways a converter can hurt you

It helps to separate these, because the fixes aren't the same.

The site is malicious. It's built to infect you. That usually happens in one of three ways: it asks you to download a "converter app", it pushes a browser extension, or the file it hands back carries something extra. This is the FBI scenario, and the defence is mostly about spotting the warning signs before you click.

The site is legitimate, but your file is now on its server. Nobody's attacking you. The company converts your file on its own machines, keeps it for a while, and deletes it on a schedule. The risk is quieter: a breach, a retention policy that isn't what it claims, or a company in a country whose privacy law you'd rather not rely on. For a holiday photo, who cares. For a medical letter, you might.

Upload converters vs. in-browser converters

There are two ways a web converter can work.

The traditional way is an upload. Your file travels to the company's server, gets converted there, and you download the result. That's how most big PDF sites have always worked, and it's the only realistic option for heavy jobs like compressing a long video or translating a whole document while keeping its layout.

The newer way runs the conversion inside your browser. The page loads some code, often WebAssembly or a JavaScript library, and your own computer does the work. Ten years ago that would have been painfully slow. Now it handles PDFs, images, spreadsheets and even OCR comfortably on an ordinary laptop or phone. And if the file never leaves your device, there's nothing on a server to leak, keep or misuse.

The well-known upload sites aren't villains, to be clear. They're the baseline to measure everyone else against. iLovePDF's security page says processed files are permanently deleted within two hours, and that it holds ISO/IEC 27001:2022 certification. Smallpdf says free uploads are deleted after one hour, with longer windows for files you share or send for signature. That's what responsible behaviour looks like for an upload service: a stated retention period, a certification you can look up, and a company with a name and an address.

A converter that tells you none of that hasn't earned your passport scan.

Three quick tests to see if a converter really stays in your browser

Plenty of sites say "secure" and "private" without meaning anything. These checks take a minute.

1. Read the privacy page, not the homepage

Homepages say "100% secure". Privacy pages say what actually happens. You're looking for a plain sentence along the lines of "files are processed in your browser and never uploaded to our servers". If instead it talks about encrypted transfer and automatic deletion, that's an upload service. Possibly a good one, but an upload service.

Watch the hedges. "Supported" tools, "most" conversions, "where possible". Some sites run simple jobs locally and send the harder ones to a server. That's fine, as long as you know which is which.

2. The airplane mode test

Open the converter and let the page finish loading. Then switch off your Wi-Fi or turn on airplane mode, and run the conversion.

If it works, the processing happened on your device, because there was nowhere else for it to happen. If it hangs or throws an error, the site needed a server. This is the quickest test there is, and it works on phones too.

3. Watch the Network tab

On a laptop, press F12 (or right-click and choose Inspect) and open the Network tab. Clear it, then convert a file. If you see a request roughly the size of your file going out, it was uploaded. If you only see small requests, the work happened locally.

One honest caveat: local processing doesn't mean zero tracking. Plenty of in-browser tools still load analytics, ads or code libraries from other servers. Your file stays put, but the visit itself may still be counted. For most people that trade is fine. Just know it's a different question.

Red flags that should make you close the tab

• "Download our converter to continue." A web converter that suddenly needs an installer is the oldest trick in this space.
• A browser extension prompt. Extensions get broad access to everything you browse. Malwarebytes notes many converter extensions turn out to be hijackers or adware.
• The result arrives as an .exe, .zip or anything other than what you asked for. A PDF should come back as a PDF.
• It's a sponsored result. Not every ad is malicious, but scroll past it and find the organic listing.
• No privacy page, no company name, no retention period. If you can't tell who runs it, don't give it anything you'd mind losing.
• The domain is a near-copy of a famous one. An extra hyphen or a strange ending like .xyz is a reason to stop.

Converters we'd use, by job

These are all listed on ToolVerified, and for each we've noted what the tool says about where your file goes.

PDFs: merge, split, compress, convert

ApexPDF is the broadest option. It lists over 100 PDF tools, says documents are processed locally and not uploaded, and says the tools keep working offline once the site has loaded, which makes the airplane mode test easy. It's free, with no sign-up.

If you only need to stitch files together, PDFTeq Merge PDF does one job in browser memory using pdf-lib, an open-source library, and copies pages across without recompressing them, so quality doesn't drop. You can't drag pages to reorder yet, so pick your files in the right order.

ToolVero covers merging, splitting, signing and watermarking, and it has a metadata scrubber, which we'll come back to. It's upfront that some features load libraries from third-party CDNs, the kind of detail we like to see written down.

Images and iPhone HEIC photos

HEIC to JPG is one of the most searched conversions out there, and every one of these does it locally. FileOnTap handles HEIC, WebP, PNG and JPG plus basic PDF jobs, and its privacy page says file contents and names aren't sent to analytics either. Image Convert can turn a batch of HEIC photos into one ordered PDF, handy for receipts and forms. Quick Image Converter runs on WebAssembly and takes batches with a ZIP download, and ImageNow covers compression and resizing for the web.

Text from images (OCR)

OCR used to be a reliable sign you were uploading, because it needed serious computing power. Photo2Text runs it in the browser with WebAssembly, with models for English, Urdu and Arabic, and lets you fix the result before copying it out.

Spreadsheets and CSV files

Customer lists and payroll exports are exactly the files you shouldn't be uploading to strangers. Free CSV Cleaner trims spaces, removes duplicate rows and standardises dates entirely in the browser.

A bit of everything

FreeToolsBox bundles 154 small tools, from PDF merging to code formatting, and describes them as client-side. Worth bookmarking if you'd rather have one trusted site than ten.

When uploading can't be avoided

Some jobs are too heavy for a browser, and that's fine as long as you know your file is travelling. Video Size Reducer compresses video on its servers, cleans up the source after processing and keeps results for about 24 hours. Doc Translator translates whole documents while keeping the layout, which needs a server. ConvertAny and Trencada both say uploads are encrypted and deleted after processing, and between them they cover formats the in-browser tools don't.

Our rule: upload services for ordinary files, in-browser tools for anything with an ID number or a salary on it.

And if you then need to send the converted file to someone, SEAL encrypts it in your browser before upload, with expiry dates and single-use links, which beats attaching a passport scan to an email that lives forever.

Don't forget what's hidden inside the file

Even a perfectly safe conversion can leak something you didn't mean to share. Phone photos usually carry EXIF data, which can include the exact GPS location where you took them. PDFs and Word files often record the author's name, the company and the software used.

Some converters strip this as a side effect. FileOnTap warns that converted images may not keep all their EXIF data, which for privacy is a plus. For PDFs, ToolVero's metadata scrubber lets you inspect and clear the document information fields before you send anything.

AI chatbots are the new file converter

A lot of people who'd never upload a contract to a random PDF site will happily paste the whole thing into ChatGPT and ask for a summary. Same move, different label.

The cautionary tale everyone cites is Samsung. In 2023 engineers pasted confidential source code into ChatGPT, and the company restricted staff use of generative AI shortly afterwards. Nobody hacked anything. People just treated a chat box as if it were private.

The same rules apply: check what the service does with your data, and strip out what the model doesn't need. Redaxa scans text before it reaches an AI model and swaps out API keys, passwords, emails and bank details for placeholders, so you get the help without handing over the real values.

If you think you've already used a bad one

Don't panic, but don't ignore it either. The FBI's advice, via Malwarebytes, boils down to this:

1. Run a full scan with up-to-date security software, and remove any converter app or browser extension you installed.
2. From a different, clean device, change your passwords, starting with email and banking.
3. If you entered or uploaded financial details, call your bank and watch your statements.
4. Sign out of active sessions on important accounts, since stolen session tokens can outlast a password change.
5. Report it at ic3.gov if you're in the US, or to your national fraud centre elsewhere.

FAQ

Is it safe to convert PDF to Word online?

For everyday documents, a well-known converter with a published deletion policy is fine. For anything with personal or financial details, use one that runs in your browser, so the file never leaves your device. Avoid any site that wants you to download software to finish the job.

Is iLovePDF safe?

iLovePDF is an established European company. It says processed files are deleted within two hours and it holds ISO/IEC 27001:2022 certification. The bigger risk is lookalike sites and ads posing as it, so check the address before you upload.

Is Smallpdf safe?

Smallpdf says free uploads are deleted after one hour, with longer storage for shared or e-signed files, and it reports ISO 27001 certification. As with any upload service, your file does sit on its servers for that window.

Can a PDF contain a virus?

Yes. PDFs can carry malicious links, embedded scripts or exploits aimed at outdated readers. Keep your PDF reader updated, and be wary when a converted file arrives in a format you didn't ask for.

How can I convert files without uploading them?

Use a converter that processes files in the browser. Check its privacy page, then try the airplane mode test: load the page, go offline and run the conversion. If it still works, nothing was uploaded.
## The short version

Most free converters aren't out to get you, but a few are, and the good ones still keep your file on their servers for a while. So match the tool to the file. Holiday photos can go anywhere reputable. Anything with your identity, money or a client's name on it belongs in a converter that never uploads it.

Browse the in-browser utilities we've checked in our productivity category. And if you've built a privacy-first tool yourself, submit it to ToolVerified and a person will read it before it goes live.