How StayPutPDF Processes Files Without a Server

A technical look at what actually runs when you merge or convert a file — for the skeptical reader who wants more than "trust us."

The short version

StayPutPDF doesn't have a "no upload" policy. It has no server-side code for your files at all. There's nothing to switch off — it was never built to send your files anywhere.

Policy vs. architecture

Most tools: a policy

Your file is uploaded, processed on a server, then the company promises to delete it. You're trusting people you can't see, on servers you can't check.

StayPutPDF: the design

The tools run in your browser tab. There's no upload address for your file to go to — it's not a rule being followed, it's how the software is built.

What runs in your browser

Every tool — merge, split, compress, redact, sign, edit, OCR and the converters — uses established open-source JavaScript libraries. They load with the page and run on your own computer or phone, reading your file in memory and building the result the same way.

  • pdf-lib — merging, splitting, compressing, signing, editing
  • PDF.js — showing pages and finding text for redaction
  • Tesseract — text recognition (OCR) for scans
  • mammoth.js, pdfmake, SheetJS — Word and Excel to PDF

It's the same kind of technology as spell-check or print preview in your browser — ordinary code running on your device.

Check it yourself in a minute

  1. Open your browser's developer tools (F12, or right-click → Inspect) and go to the Network tab.

  2. Use a tool — merge or redact a file — and watch the Network tab the whole time.

  3. Look for a request carrying your file. There isn't one. You'll see the page's own code, libraries and anonymous usage counts — never your document. See the full list of requests.

Even simpler: open a tool once, turn off Wi-Fi, and use it. It keeps working. (OCR downloads its language pack the first time you use a language — that's a download to you; your file still isn't sent.)

What this does — and doesn't — guarantee

What it means

Your file's contents are never sent to StayPutPDF or anyone else. There's nothing to breach, subpoena or misuse on our side — we never receive it.

What it doesn't cover

Your own device's security (malware, an unlocked laptop) or browser extensions with broad permissions. Local processing removes one risk, not every risk.

Try it