Is online file conversion safe? A checklist

Free to read · ConvertMango guides

Free converters are everywhere, and most people choose one by whatever turns up in a search. That is a reasonable way to find a tool but a poor way to judge one. Below is a checklist you can apply to any converter, ours included, followed by an honest account of what our own tools do and do not claim.

First, the honest answer

"Is online conversion safe?" has no single answer, because websites differ. The risk depends on three things: how you reached the site, where your file goes while it is converted, and what you download at the end. The checklist takes each in turn. None of it needs technical skill.

Check 1: the address and the padlock

What to do: read the web address in full before you add a file. Make sure it begins with https and that the domain is spelt as you expect.

What it tells you: MDN explains that TLS, the technology behind HTTPS, provides assurances about confidentiality, authenticity and integrity of communications. RFC 9110 says that for an https address the server is authenticated for the named authority and the communication gets confidentiality and integrity protection. In plain terms, nobody on the network between you and the site can read or alter what you send.

What it does not tell you: whether the site is honest. The UK government's fake-website advice says neither the padlock nor https guarantees a site is legitimate or reputable; they mean your connection is secure. If the padlock is missing or the browser says "not secure", that advice is not to use the site. Lookalike domains also exist: the NCSC warns that criminals may use a deceptive domain that resembles a genuine one, and suggests typing an official address directly or searching and reading the results rather than clicking the top item.

Check 2: where is the file processed?

This is the most important question and the one most sites answer vaguely.

• In your browser. The page's code reads the file on your device, converts it, and hands you the result. MDN notes that web content can ask the user to select local files and then read them, and uploading to a server is a separate step a site has to choose to take.
• On the provider's server. Your file is sent over the internet, converted elsewhere and sent back. That is not automatically unsafe, but the file now sits on someone else's system, and the next checks matter much more.

How to find out:

1. Read the page. A site that processes locally usually says so; a site that uploads usually mentions "upload" and "servers".
2. Read the privacy policy for words such as "upload", "store" and "third parties".
3. If you are comfortable with your browser's developer tools, open the network panel, convert a harmless test file, and see whether your file was sent anywhere. Do not test with a sensitive document.

Check 3: what happens to uploaded files?

If processing is on a server, look for clear answers to these:

• How long is the file kept after conversion?
• Is it deleted automatically, and is that stated in a policy rather than only in a tagline?
• Who can access it, including staff and sub-processors?
• Is it used for anything other than the conversion, such as analysis or training?
• Where is it stored, and under which country's rules?

The Stop! Think Fraud advice includes looking for limited-company information on "About us" or "Contact us" pages and for a privacy policy and terms and conditions. A converter with no named company, no contact route and no policy has told you something. Reviews on several independent sites help too, and the same advice notes that a professional-looking design does not prove legitimacy.

Check 4: what you are asked to download

A converter should give you the file you asked for. Be careful if:

• The result is a program or installer when you asked for a PDF, image or document. The file extension tells you what you got.
• You are told to install an extension, app or "downloader" before you can continue.
• The site says the file is ready but sends you through several unrelated pages first.

If something looks wrong, close the tab and delete the download rather than opening it. Keep your operating system and security software up to date.

Check 5: what the site asks you to allow

A converter has no need for your location, microphone, camera, contacts or notifications. Decline permission prompts that are unrelated to the job. Be cautious about sites that ask for an email address, phone number or card details before showing you any result; read what you are agreeing to.

Check 6: how sensitive is the file?

Be stricter in proportion to what the file contains. A holiday photograph is one thing. A passport scan, a contract, medical records or a company's financial statements are another. For those:

• Check whether you are allowed to put the file through a third party at all. Employers, clients and regulators often have rules.
• Prefer software already installed on your own device.
• If you must use a website, choose one that processes in your browser, and confirm that with Check 2.
• Remove password protection only if you are entitled to.

A quick scoring sheet

If you cannot tick most of the first column, use a different tool or software on your own device.

What ConvertMango says about itself

Here is what we are willing to claim, and where the limits are.

• The tools that are live today run in your browser, and the file contents are not uploaded to our conversion service. They are: JPG to PDF, PNG to PDF, PDF to JPG, PDF to PNG, Merge PDF, Extract PDF pages, and the image converters between JPG, PNG and WebP.
• The site offers only the tools it supports today. Audio, video and advanced document conversion are not offered, so there is nothing to upload for them.
• We do not offer a security certification, and we cannot see your device, your browser or your network. Treat this as a description of how the tools work, not a guarantee. The checklist above applies to our site too, so please use it.
• Each tool has file limits. For example, JPG to PDF accepts up to 30 files and 50 MB in total, and PDF to JPG takes one PDF up to 50 MB and 50 pages.
• Large files can exceed the memory available on your device, because the work happens there.

Good habits whichever tool you use

1. Convert copies, never your only original.
2. Remove anything you do not need to share before converting, for example by extracting only the pages you need.
3. Check the result before sending it anywhere.
4. Use a tool once you have judged it, rather than whichever site is top of the results.
5. If you are unsure, do not upload.

To see what a local, in-browser tool looks like in practice, try Merge PDF on a non-sensitive test file and read the merge guide. For what the format itself can contain, see what is a PDF.

Frequently asked questions

Related tools

More guides

Sources

Plain-text references. Facts that could not be checked against a primary source were left out.

1. MDN Web Docs, 'Transport Layer Security', https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/TLS
2. IETF, 'RFC 9110: HTTP Semantics', section 4.2.2 'https URI Scheme', https://www.rfc-editor.org/rfc/rfc9110.html
3. Stop! Think Fraud (UK government), 'How to spot a fake website', https://stopthinkfraud.campaign.gov.uk/how-to-spot-fraud/how-to-spot-a-fake-website/
4. NCSC (UK), 'Shopping and paying safely online', https://www.ncsc.gov.uk/guidance/shopping-online-securely
5. MDN Web Docs, 'Using files from web applications', https://developer.mozilla.org/en-US/docs/Web/API/File_API/Using_files_from_web_applications