Is it safe to merge PDF files online, or does the site upload them?
It depends on the site: some PDF mergers upload your files to a server, and others combine them inside your browser. You can check any site yourself with the browser's Network panel. When we merged two sample PDFs on Osmanth Docs, the page made only GET requests and sent nothing to an API.
How can I check whether a site uploads my file?
Every modern browser can list the requests a page makes. The steps below work on any site, not only ours.
- Open the merge page, then open the browser's developer tools. In Chrome press Ctrl+Shift+J (Cmd+Option+J on a Mac) and click the Network tab. In Firefox press Ctrl+Shift+E (Cmd+Opt+E on a Mac).
- Do this before you add any file. Chrome records requests only while DevTools is open, so anything sent earlier is not shown.
- Click Clear to empty the list, then add your files and press the merge button.
- Look at what appears. Use the Fetch/XHR filter in Chrome to hide images and scripts. Select a request and open its Payload tab to see the data that was sent with it.
- A file upload shows up as a request that goes out when you add or merge. Select it and check the Payload tab. Do not rely on the Size column: in Chrome it describes the response, not what you sent. Page loads, scripts, stylesheets and logos are normal and carry no file data.
The check has one limit: it shows what the page does while you watch. A site can change its code later, so it proves the past and not a promise.
What did we see when we merged two PDFs here?
We opened the Merge PDF page on osmanthdocs.com in a browser with the network log recording, and added two small sample PDFs that we made ourselves (two pages and three pages, invented content). We merged them and downloaded the result.
The log listed six requests, all of them GET requests for the site's own files:
| Request | What it is |
|---|---|
| The page itself | The Merge PDF page |
| Two script files | The site's code |
| One stylesheet | The page's styling |
| One image | The site logo |
| One more script file | The code that does the merging, loaded when the files were added |
There was no POST request and no request to the site's API. The merge code runs in your browser tab and builds the new file on your own device.
What does the merged file contain?
We opened the downloaded file with a PDF library. It had five pages in the order we expected: both pages of the first file, then all three pages of the second. Its Title and Author fields were empty, and its Producer field named the open-source library that wrote it, pdf-lib. The fields that our two source files carried were not copied across.
What are the limits?
- Passwords. A password-protected PDF is refused with a message asking you to remove the password first.
- Size. The page rejects a single file over 200 MB. Below that, very large files depend on your device's memory.
- Bookmarks. In an earlier test with a published paper that had bookmarks, the merged file had none. Page content was kept, but the bookmark panel was empty.
- Time. Our test shows how the page behaved on 2026-10-11. Check again if it matters.
What happens to your file on the rest of this site?
Merge PDF and Split PDF run in your browser and do not upload your files. The conversion tools on this site work differently. Your PDF is uploaded to our servers, where open-source software processes it. It is not sent to any third-party AI or document API. The uploaded PDF is deleted as soon as processing finishes, and the results stay for 60 minutes. Files can be up to 50 MB and 100 pages. The privacy page has the full wording.
To send only part of a long document, read how to send only some pages of a PDF.