What happens to your files after you upload them to a free converter?

What happens to a file after you upload it to a free converter? It is copied to the company's server, processed there, and kept for some hours or days before the company says it deletes it. You cannot check that it was really deleted. Researchers have found converter services with user files sitting in open cloud storage, and the FBI has warned that fake converter sites are used to spread malware.

The normal journey of your file#

When you drop a PDF on a converter site, this is what happens step by step:

1. Your browser uploads the file to the company's server. The file now exists on a computer you do not control.
2. Their software processes it and makes the result.
3. You download the result. The site shows a message like "files are deleted after 24 hours."
4. After the stated time, the main copy is removed.

Step 4 is where the honest questions start. "Deleted" usually means the main file row in their database. It does not cover everything else a server keeps.

What "deleted after 24 hours" leaves out#

A running server keeps more than your file. It keeps logs of requests, temporary files from processing, error reports when something crashes, and automatic backups of its storage. These can hold your file, or pieces of it, long after the main copy is gone. Even a company that fully intends to delete your data can keep invisible copies without knowing it.

Then there is the policy itself. Some services are vague about how long they keep files, and researchers have criticised popular converters for storing uploads longer than users expect. The policy is a promise, not something you can verify. Once the file is on their server, you are trusting their word, their security, and every employee and contractor with access.

What researchers actually found#

This is not hypothetical. Two cases from the last two years:

The FBI warning (March 2025). The FBI's Denver field office warned that criminals were running fake file-converter sites to spread malware and steal data. Some sites were clones of real converters, copied down to the design and URL. Victims who "converted" a file got malware instead, and the attackers harvested IDs, banking details, passwords and crypto seeds. The malware families named were Nitro Infostealer, Amadey and Rhadamanthys, spread through poisoned search results.

The open storage (July 2024). Cybernews researchers found cloud storage belonging to converter services PDF Pro and Help PDF left wide open: 89,062 files anyone could browse, including passports, IDs, certificates and contracts. These were real users' files, uploaded for conversion, sitting in storage with no password.

On top of that, Bitdefender's 2026 guidance answers the direct question plainly: "Is it safe to upload confidential documents to online file converters? No."

Why "free" deserves one honest question#

Running servers costs money. A free converter pays for it somehow: ads, paid plans, or your data. Some services train their software on uploaded documents. Some share data with ad partners. None of this means every converter is malicious. Many are honest businesses. But the business model question is fair to ask before you upload a scan of your passport.

The part you can control#

You cannot verify a stranger's deletion policy. You can remove the stranger. If the conversion happens on your own computer, there is no server, no retention policy and nothing to leak.

KinoFlux Editor is a free offline toolbox for exactly this: 66 tools for video, audio, images, PDFs and documents that run on your Windows or Mac with no upload, no account and no telemetry. Merging two PDFs works like this:

1. Drop the PDFs on the window.
2. Press Ctrl+K, pick PDF - Merge.
3. Press Ctrl+Enter. The merged file is written next to the originals.

The file never leaves the machine, so the whole question of what happens after upload never comes up.