The privacy problem with online PDF mergers

Search merge PDF online and the top ten results are all variations of the same architecture: you drop files onto a web form, the files POST to a server, a backend process merges them, the result comes back as a download link. The UX looks instant. The privacy footprint is not.

Every one of those servers holds your documents for at least a few minutes, sometimes hours. Most privacy policies promise deletion after 1 to 2 hours or when processing completes. That is probably true for normal traffic. It is not verifiable. It does not help you if a server is compromised during the window. It does not help you if the vendor is subpoenaed. It does not help you if the vendor is secretly training a machine learning model on the documents flowing through.

For most casual use this is fine. Combining two photos of a grocery receipt — who cares. But PDF is the universal format for sensitive documents: invoices with business details, contracts with signatures, tax returns, medical records, bank statements, legal filings. Routing these through a third-party server violates internal security policies at almost every company.

How browser-based PDF merge works

Modern browsers are full application runtimes. They can read files from your disk via the File API, parse binary formats in JavaScript, and download the result as a Blob — without ever sending the bytes over the network.

SammaPix PDF Merge uses pdf-lib, an open-source PDF manipulation library written in TypeScript. The library implements the PDF specification well enough to parse a PDF byte stream into a document object, copy pages across documents while preserving shared resources, serialize the merged document back to PDF bytes, and return the bytes as a Blob for download.

The entire operation happens inside your browser tab JavaScript sandbox. Open DevTools Network during a merge and you will see zero outbound requests that contain your PDF data. The only traffic is the initial page load and optional analytics pixels that contain no file content. Read the tool source yourself — pdf-lib is MIT-licensed on GitHub.

How major PDF tools handle your files

A quick audit of top-ranked PDF mergers in April 2026. iLovePDF: uploads server-side, retains for a few hours. SmallPDF: uploads server-side, retains for 1 hour per policy. PDF24: uploads server-side, short time unspecified. Adobe online: uploads to Adobe cloud, manual deletion required. PDFsam desktop: runs locally, open source Java, no upload. SammaPix PDF Merge: browser only, no transmission.

The four server-based services are generally reputable and their claims are probably honest. The point is not that they are evil — it is that you cannot verify the claims and you do not have to make the tradeoff at all.

When PDF privacy matters

Privacy concerns are not paranoia — they map to concrete, common situations. Freelance invoicing: your invoices contain client names, rates, business addresses. Employment contracts and offers: signed versions contain full names, SSN, salary details, home addresses. Medical records: HIPAA in the US and GDPR in the EU put meaningful liability on transmission to unqualified third parties. Tax returns: often contain full financial fingerprints. Legal filings: attorney-client privileged material must not transit third-party cloud services.

Encrypted and password-protected PDFs

PDF has two common encryption modes that often get conflated. Encrypted-for-viewing: the file is technically encrypted but the viewing password is blank. Adobe Reader opens it without prompting. Most office-generated PDFs are in this category. Password-required: genuinely locked, requires the password to render.

SammaPix PDF Merge loads PDFs with ignoreEncryption true which handles case 1 transparently. Case 2 requires the password to decrypt before merging.

What gets preserved in the merge

Text content: yes, pixel-perfect. Images and graphics: yes, pixel-perfect. Fonts embedded and non-embedded: yes. Hyperlinks: yes. Form fields fillable: yes, mostly. Annotations and comments: partial, simple ones preserved. Digital signatures: preserved but invalidated because merge changes bytes. Document-level bookmarks: not preserved, known limitation. Attachments (files embedded in PDF): partial.

For bookmark-heavy workflows a desktop tool like Adobe Acrobat or PDFsam is better. For invoicing, contract packs, and most office use cases the browser-based merge handles everything.

The merge workflow step by step

One: open SammaPix PDF Merge. Any modern browser works. Two: drop up to 10 PDFs on the free plan, 50 on Pro, 100 megabytes per file max. Three: drag rows up or down to set the final order. Click the trash icon to remove files. Four: click Merge N PDFs. Progress bar shows page-by-page combine. Five: download the merged PDF.

How to verify no upload happened

Do not take our word for it. Verify yourself. One: open Chrome or Firefox DevTools. Two: go to the Network tab. Three: check Preserve log so entries persist across page changes. Four: load the PDF Merge page and clear the log. Five: drop your PDFs and run the merge. Watch the Network tab. Six: no requests with your PDF bytes as payload. The only entries will be static assets or at most a small analytics beacon with zero file content.

Offline alternatives if you need desktop

For larger batches, bookmark-preserving merges, or air-gapped environments, these desktop tools run fully offline. PDFsam Basic: open source Java app, Windows Mac Linux, preserves bookmarks, no file size limit. pdftk: command-line tool for Linux Mac, scriptable, preserves everything. Preview on macOS: built-in, drag pages between PDFs in thumbnails view. Adobe Acrobat Pro: paid, full feature set.

Free browser-based PDF tools

SammaPix runs three complementary PDF tools, all client-side via pdf-lib. PDF Merge for combining multiple PDFs. JPG to PDF for building PDF from images. PDF to Image for extracting images from PDF.

FAQ

Do most free PDF mergers upload my files? Yes — most of them. iLovePDF, SmallPDF, PDF24, Adobe online all route uploads through servers. Browser-based tools like SammaPix PDF Merge run locally.

Is merging PDFs in the browser secure for sensitive documents? Yes — provably more secure than server-based alternatives. Verify by opening DevTools Network tab during a merge.

How does pdf-lib handle encrypted PDFs? SammaPix loads with ignoreEncryption true which handles encrypted-for-viewing transparently. Password-required PDFs must be decrypted first.

Can I reorder PDFs before merging? Yes. Drag rows up or down after upload.

What is the file size limit? Up to 100 megabytes per file, 10 files per batch on free, 50 on Pro.

Does the merged PDF preserve bookmarks and form fields? Text images page layout and most form fields are preserved cleanly. Document-level bookmarks are a known limitation of client-side PDF libraries.

---

Originally published at sammapix.com

Try it free: SammaPix — 27 browser-based image tools. Compress, resize, convert, remove background, and more. Everything runs in your browser, nothing uploaded.