Toolium

Why I refuse to upload your file

Hemanth Gedda11 min read

Last summer a friend asked if I could combine a six-page rental agreement with three signed addenda into one PDF. She had already tried three free online tools. The first one wanted a sign-up. The second added a watermark across every page. The third silently downscaled her scans so the text on page 11 came out unreadable. She was on a deadline. She asked if I could just do it for her.

That moment is the most common shape a Toolium tool gets used in. Somebody hits a wall on a free site, gives up, tries a different free site, hits a different wall, eventually finds something that works. Most of those free sites work in a way nobody would actually agree to if they thought about it for thirty seconds.

The standard architecture

The standard flow at a free PDF tool site goes like this. You visit the page. You drag your file onto an upload box. The file travels over HTTPS to a server somewhere. A Python or Go process runs on that server, parses your PDF, does the operation, writes the output to a temp directory, returns a download URL. You click the URL and your output downloads. The server, in theory, deletes your input after some retention window. The page shows you a couple of ads while you wait. Total elapsed time: 8 to 30 seconds, depending on file size and how busy the server is.

What that flow requires you to trust, even before you accept the marketing copy:

  • The site operator does not log file contents during processing.
  • The retention window is what they claim (most policies say 1 hour; some say 24 hours; some are silent).
  • The intermediate caching layer (CDN, edge servers) does not retain a copy past the retention window.
  • The server is not compromised, and the operator notices and discloses if it is.
  • The third-party logging service the operator uses (Datadog, Sentry, etc.) does not capture file contents in error reports.
  • No employee of the operator pulls your file out of a temp directory for inspection during the retention window.
  • The host country's law enforcement does not subpoena the file during that window.

Most users go through that list once, recognize that they cannot verify any of it, and decide that the convenience is worth the trust. For most files, that calculation is fine. For a few - your tax return, a contract, a medical record, a will, anything involving someone else's confidential information - the calculation should come out the other way.

The business model

"Free" online file processing is rarely free in the way the page implies. The tools that do not charge a subscription get paid through some combination of:

  • Ad networks, which pay for impressions on your visit. They get your IP, browser, referrer, and inferred demographic.
  • Affiliate lead-gen, if the site can get your email address (the dark pattern is a "we will email your finished PDF" workflow that does not need email at all).
  • Data brokering on aggregated metadata: file types, file sizes, action frequencies, geographic regions. This data is anonymous in the privacy-policy sense and identifying in the practical sense.
  • Premium upsells. The free tier has a watermark, a 5MB limit, a 10-conversion-per-day cap, anything that makes the paid tier appealing.
  • In the worst cases, paid inspection of the documents themselves. The FTC sued a "free medical records tool" in 2023 for selling the parsed records to data brokers.

The combination of these means the site has economic reason to know more about you than the marketing implies. Even when the file is genuinely deleted after the retention window, the metadata about who uploaded what kind of file when has business value, and the standard SaaS infrastructure stack captures that metadata by default.

The technical alternative

None of this is necessary. Browsers in 2025 ship the same primitives that ten years ago required Python on a server. PDF parsing, image decoding, hashing, even basic video encoding. The combination of WebAssembly, Web Workers, the Canvas API, the File API, and the SubtleCrypto API closes most of the "we need a server" gap.

A short list of operations that no longer need a server:

  • PDF merge, split, page extraction: pdf-lib, a 600KB library, runs in any browser.
  • JPEG and PNG re-encoding: native canvas API.
  • Spreadsheet read and write (xlsx, xls, csv): SheetJS, also browser-native.
  • JSON parsing and formatting: built into the language.
  • Regex matching: native, with Web Worker isolation for safety.
  • Cryptographic hashes (SHA-256, SHA-512): SubtleCrypto, native since 2017.
  • Base64 and URL encoding: native function calls.
  • Markdown rendering: marked plus DOMPurify, both small.

The operations that genuinely still need a server are smaller than people assume. OCR is the main one - the open-source browser OCR libraries (Tesseract.js) work but the quality and speed are visibly worse than desktop alternatives. Video transcoding to formats not natively supported in browser encoders. Anything that requires a database lookup or a third-party API with CORS restrictions. The rest is browser territory.

The thirty-second test

Here is something a user of any free tool site can do that takes less than a minute. Open the page. Open Chrome's DevTools, switch to the Network tab. Clear the log. Drag your file onto the tool, click the action button, and wait for the result. Look at what got requested while the operation ran.

You should see a few analytics beacons and ad-related requests, all of which are common. What you should not see is a POST request to the site's own domain with a body size matching your input file. If your 5MB PDF shows up as a 5MB request payload, the processing is server-side and the marketing copy is misleading.

Toolium tools were designed to pass this test. Run the network tab while merging a PDF on devtoolium.com. You will see Vercel Analytics beacons (cookieless, no file metadata), AdSense requests for the iframe, maybe Google Analytics if you accepted cookies. You will not see your file leaving the page.

The honest second-order question

I want to be careful here, because there is a more sophisticated version of the privacy critique that catches even sites like Toolium. Even when the file content is processed locally, the page itself loads Google Analytics, AdSense, and (with consent) Microsoft Clarity. Each of those reports metadata to a third party. Is that not, in effect, similar to uploading?

It is similar but distinct. The metadata Google Analytics sends includes the URL you visited, your approximate location, your browser, and your interaction events. It does not include the file you processed. AdSense sees the same metadata plus the ad-serving context. Clarity captures interaction patterns, with form and text content masked by default.

None of that is zero-telemetry. If your threat model requires zero telemetry, every commercial website fails it. The Toolium tools work offline once the page has loaded, which is the closest you can get to zero-telemetry on a commercial site: disconnect from the network after the page loads, the tools keep working, no further requests fire.

The honest claim is: the file you process is private, the metadata about your visit is shared with the analytics and ad providers disclosed in the privacy policy, and you can verify both claims by reading the source or watching the network.

What the default should be

The default for tools that move files around should be: process locally, surface that fact prominently, run no telemetry on the file content, disclose what metadata does flow. That this is not the default in 2025 says something about the incentive structure for tool businesses. Server-side is cheaper to operate (one process handles all users, no library push to every browser) and easier to monetize (the operator sees what users are doing).

I built Toolium partly to argue against that default. The argument is technical, philosophical, and economic. The browsers got fast enough. Your files are not the operator's business. And a privacy-first tool site can still be supported by ads on the page, even if it cannot be supported by adtech on the file itself.

The next time you reach for a "free online" something, take the thirty-second network-tab test. If your file is leaving the page, ask yourself who else gets a copy, and whether the work you are doing in that minute is worth their cost.