Do free PDF merge sites upload your files? We watched 12 of them
A Network-tab test with blank PDFs, dated 5 October 2026: only what we observed, nothing about intent.
Drag & drop PDF files here
or
Free: up to 5 files, 20MB total
Your merged PDF is ready.
Download merged.pdfThe result in one paragraph
On 5 October 2026 we added two blank test PDFs to 12 free online PDF merge tools and watched the browser's network requests. In 11 of them we saw outgoing requests that carried, or were exactly the size of, our files, sent to the site's servers or storage. In 1 we saw no such request. Uploading is how most of these services work, and most say so on their own pages: this is not an accusation. It is a way to see, instead of trust, where a file goes before you drop a contract or an ID scan on one.
How we tested
- Files: two generated PDFs, 20,555 and 31,559 bytes, each one blank page carrying a random marker string. No real documents were used.
- Browser: an automated Chromium session with no login and no extensions, one session per site, on 5 October 2026. Results can differ by country, browser and over time.
- Steps: open the site's merge page, select both files, press the merge button if one was offered. Nothing else was clicked. We did not solve or get around any captcha or block.
- What counts as an upload: an outgoing POST or PUT request whose body contained the marker, or whose size matched one of the files (or both together) plus a small overhead, sent to anything other than analytics or ad hosts. A browser cannot always read file bodies, so a size match is stated as a size match.
- Controls: this tool (no matching request) and iLovePDF (matching requests) behaved as expected before the full run.
Results
| Site | Did the files leave the browser? | What we observed |
|---|---|---|
| AvePDF | Yes | POST to avepdf.com: 1 request, 52,623 bytes |
| CombinePDF | Yes | POST to combinepdf.com: 2 requests, 20,745 and 31,749 bytes |
| DeftPDF | Yes | POST to deftpdf.com: 1 request, 53,183 bytes |
| HiPDF | Yes | PUT to eus-storage.pdfelement.io: 2 requests, 31,559 and 20,555 bytes |
| iLovePDF | Yes | POST to api65.ilovepdf.com: 2 requests, 21,785 and 32,789 bytes |
| LightPDF | Yes | PUT to lightpdfhk.oss-cn-hongkong.aliyuncs.com: 2 requests, 20,555 and 31,559 bytes |
| PDF Candy | Yes | POST to s33.api.pdfcandy.com: 2 requests, 20,555 and 31,559 bytes |
| PDF24 | Yes | POST to filetools31.pdf24.org: 2 requests, 20,745 and 31,749 bytes |
| Sejda | Yes | POST to www.sejda.com: 2 requests, 21,108 and 32,112 bytes |
| Smallpdf | Yes | PUT to smallpdf-production-files.r2.cloudflarestorage.com: 2 requests, 20,555 and 31,559 bytes |
| Soda PDF | Yes | POST to api-gw.sodapdf.com: 2 requests, 20,943 and 31,947 bytes |
| PDFgear | No upload seen | Both files were added and the page listed each with its page count; no outbound request of the files' size was seen. We did not complete an export in this run, so this shows loading, not the full merge. |
Sites we could not test:
- Adobe Acrobat online: the site answered "Access Denied" to the headless browser; we did not try to get around it.
- Foxit: no file input found on the page.
- Online2PDF: the merge did not complete in our automated run.
- PDF2Go: the test did not finish within our time limit.
- FreePDFConvert: the test did not finish within our time limit.
- PDF Resizer: the test did not finish within our time limit.
- DocuPub: its form takes one file at a time, so the two-file test did not apply.
- PDFaid: the merge page we tried was not found.
- CleverPDF: the merge page we tried was not found.
What this test does not show
- What happens to a file after it arrives: how long it is kept, who can read it, whether it is encrypted. Read each site's own privacy page for that.
- Anything about paid plans, the apps, or other tools on the same sites.
- That a site with no upload seen never uploads: another button, file size or country could behave differently.
- Intent. A request carrying a file is how a server-side merge works.
Check it yourself in two minutes
- Open the merge page, then your browser's developer tools (F12) and its Network tab.
- Tick Preserve log, then add a test PDF you do not mind sharing.
- Sort the requests by size, or filter by Fetch/XHR, and look for a POST or PUT about as large as your file.
This tool for comparison: the merge runs in your browser tab. In our run no request carried the files; the page loads itself from this site and asks hexloomlabs.com whether Pro is active, a small request with no file data. More on how that works and its limits.
More about merging PDFs
- Combine PDF files online
- Merge PDFs without Acrobat
- Change the order before merging
- Merge large PDF files
- Password-protected PDFs
- Merge scanned PDFs
- Merge PDFs without losing quality
- Merge PDFs on Mac, Windows or Linux
- Merge PDFs for a job application
- Merge bank statements into one PDF
- Merge receipts into one PDF
- Fit a merged PDF in an email
- Merge PDFs on iPhone and Android
- Merge PDFs with different page sizes
- Merge PDFs offline
- Merge two PDF files
- Add a signed page to a contract
- Merge invoices for your accountant
- Merge a meeting pack
- Merge homework scans into one PDF
- Merge 10+ PDF files using batches
- Merge Word and PDF files
- Merge photos and PDF files
- Merge PDFs in different web browsers
- Merge PDFs on a Chromebook
- Sort PDFs by naming before merging
- Add a cover page to a PDF
- Add appendices to a PDF report
- Merge thesis chapters into one PDF
- Merge PDFs for printing
- Merge presentation handouts into one PDF
- Merge confidential documents
- iLovePDF alternative: no upload
- Smallpdf alternative: no upload
- Sejda alternative: no upload
- PDF24 alternative: no upload
- Merge PDFs without uploading them
- No signup, no watermark
Free, with an optional Pro unlock
Pro is Hexloom Pro, $29 a year or $4 a month, one subscription for every Hexloom tool. It removes the 5 file and 20MB limits. There is no account: Pro unlocks the browser you subscribe in, and the confirmation page has a link to restore it elsewhere.