You have a few PDFs — a signed contract split across pages, a set of receipts, a scanned form — and you need them as one file. You search "merge PDF," click a clean-looking site, drag your files in, and download the combined result. It works. But in those few seconds, your documents were almost certainly sent to a company's server and merged there. Most sites never say so out loud.
For a public flyer, that's nothing. For the documents people usually merge — employment agreements, tax returns, medical records, bank statements, a photographed passport — it's worth pausing on. This guide explains why online merging normally means uploading, and how to avoid it.
Why "online" almost always means "uploaded"
The word online hides the important part. On a conventional PDF tool, clicking "merge" ships the raw bytes of every file across the internet to the provider's server. The server stitches them together and sends one PDF back. Your originals now sit, at least briefly, on hardware you don't control.
That design exists for a simple reason: for years, servers were the only thing that could parse and rewrite a PDF. Browsers couldn't. So the whole category grew up around uploading, and the habit stuck even after it stopped being necessary.
The practical consequences are the same ones that apply to any upload:
- Transmitted across the network, where a weak connection can be intercepted.
- Stored, at least temporarily, on the provider's disks — sometimes minutes, sometimes far longer.
- Potentially logged or cached, governed by a privacy policy almost nobody reads.
None of that is inherently sinister. But you're often merging exactly the files you'd least want copied anywhere, and "we delete it after an hour" is a promise, not a mechanism.
The browser-based alternative
Modern browsers changed what's possible. Using WebAssembly and open-source libraries, a browser can now parse real PDF structure, copy pages between documents, and write out a new file — all on your own device. There's no upload step because there's no server doing the work; your own CPU does it.
That's the approach IMG.DIY's Merge PDF takes. You drop in your files, it lists each one with its page count and size, you set the order with up/down arrows and remove anything you added by mistake, then it merges and downloads a single PDF. Nothing leaves your machine. No account, no daily cap, and once the page has loaded it works with the network switched off entirely.
The differences are immediate. A twenty-page merge doesn't crawl behind an upload bar. There's no server-imposed file-size ceiling. And there's nothing to leak, because nothing was transmitted or stored in the first place.
What it does and doesn't do
Being honest about scope matters. This tool merges whole files, in the order you set — it joins them, top to bottom. It does not yet split PDFs, delete or rotate individual pages, or reorder pages within a single file. Reordering is at the file level. If page order inside one document is wrong, fix that document first, then merge.
One caveat: a PDF locked with an open password (the kind that prompts before it will display) can't be read in the browser — remove the password first, then merge the unlocked copy. Files with owner-only restrictions can usually still be merged.
The bottom line
Before you drag a private PDF onto a random site, ask one question: does this need to leave my device at all? For merging, the answer is no. A browser-based tool does the same job, faster, and keeps your documents exactly where they belong — with you.