Convert Confidential Documents Without Uploading Them
If the file in front of you is a signed NDA, an HR investigation record, a client's legal draft, or a patient chart, "just upload it to a free converter" isn't a casual decision — it's the exact thing a confidentiality clause or professional duty usually tells you not to do. The moment a document leaves your machine and lands on a third party's server, you've disclosed it to that third party, no matter how good their privacy policy sounds.
Why "they delete it after 24 hours" doesn't fully solve this
Most free online converters are upfront, somewhere in their terms, that files are deleted after a set window. That's a reasonable policy for non-sensitive files. But confidentiality obligations are usually about access, not just retention — if a document sat on someone else's server even briefly, readable by their systems and staff, that's already the kind of exposure an NDA or a duty of confidentiality is written to prevent, independent of whether it was deleted an hour later.
How FormatDog avoids the question entirely
Every tool here — merging, splitting, redacting, password-protecting, watermarking, converting between formats — runs as JavaScript and WebAssembly directly in your browser. Your document is read from your device's memory, processed there, and the result is handed back to you the same way nothing ever travels to a server. See the Transparency page for the exact open-source libraries doing that work, and a live test you can run yourself to confirm nothing is uploaded.
Common confidential-document tasks this covers
- Redact PDF — black out sensitive sections before sharing a document, without the unredacted version ever reaching a server.
- Password Protect PDF — lock a file down before it leaves your hands, not after it's already been read by someone else's system.
- Sign PDF — add a signature to a contract without uploading the contract to do it.
- Watermark PDF — mark a draft "Confidential" or "Do Not Distribute" locally.
- Merge PDF — combine multiple sensitive documents into one packet without a server ever seeing the combined content.
The honest caveat
This isn't a substitute for reading your organization's actual confidentiality policy or asking your compliance team what's approved for use — some workplaces require specific vendor sign-off regardless of how a tool is architected. What running client-side does give you is a genuinely simpler starting position: there's no upload to review, approve, or worry about, because there isn't one.