Test 1: watch the network
- Open a TotPDF tool, for example Merge PDF.
- Open the developer tools (F12, or Ctrl+Shift+I; on a Mac, Cmd+Option+I) and go to the Network tab. In Safari, first turn on the Develop menu in Settings.
- Clear the request list, choose your PDF and press the tool’s button.
- Look at the list: no request sends your file. Uploads are POST or PUT requests, and none carries your document.
Test 2: go offline
- Open the tool and choose your file. The tool loads what it needs here, when you choose the file.
- Turn on airplane mode or switch off Wi-Fi.
- Press the tool’s button. The result is still created and you can download it, because everything happens on your device.
Test 3: read the page’s rules
- In the Network tab, click the page request and find the content-security-policy header.
- You will see that connect-src only allows TotPDF’s own site, blob: and data:. There are no third-party domains.
What you should see
You will see requests that download the page, the code, the fonts and the images. Those are downloads to load the tool, not uploads of your document.
What this shows and what it does not
It shows that your browser sends the file nowhere while you use the tool. It does not protect against browser extensions or a compromised device, and the server sees the normal requests that load the website, like any other site. More detail on the privacy page.