SealedPDFSealed · verify it

Don't trust us. Check.

Every PDF site says “your files never leave your device.” The sentence is free to write and impossible to see. So instead of asking you to believe it, here are three checks you can run yourself in under a minute.

Check 1 — the airplane test (10 seconds)

  1. Open any tool on this site, for example the merger.
  2. Turn on airplane mode, or pull the network cable.
  3. Merge your PDFs. It works — because nothing was ever going to a server.

A tool that uploads your file cannot survive this test. Ours are ordinary static pages; after your first visit they are cached and run entirely offline.

Check 2 — watch the network panel (30 seconds)

  1. Press F12 (or right-click → Inspect) and open the Network tab.
  2. Load a tool page, then process a file.
  3. Watch the request list: page assets load once, and then — nothing. No POST, no upload, no request carrying your file, during or after processing.

Check 3 — the browser enforces it (for the skeptical)

Every tool page on this site is served with a Content-Security-Policy that includes connect-src 'self'. That is an instruction to your own browser: this page may not make requests to any other domain — no analytics endpoints, no “error reporting” that happens to include your document, no third-party anything. The browser, software you already trust, enforces it; we couldn't exfiltrate cross-origin if we wanted to.

You can confirm the header in the same DevTools window: Network tab → click the page document → Headers. And because there is no server-side processing, there is also nothing for us to log, retain, or “delete after one hour”.

What tool pages deliberately don't have

  1. No analytics or tag managers on any tool page — we don't know what files you process, and can't.
  2. No accounts, no quotas that need to identify you, no cookies set by us.
  3. No external fonts, scripts or CDNs on tool pages — every byte the tools run is served from one origin.

The honest edges

Here is the complete list of what does touch the network, so this page never overclaims. The site itself has to be downloaded once (that's the point of the web), and app updates fetch the same way. Our content pages — guides, about, legal — run ordinary page-view analytics like any blog does; those pages never touch your files, and the tool pages where files are handled run none. You can watch this boundary yourself in the Network tab: guides request analytics scripts, tool pages request nothing. If we ever ship a tool feature that needs a network call — say, trusted timestamping of signatures — it will say so on the tool, in front of the button, before anything happens.