Is Smallpdf safe?

Yes. Nothing we read or measured points the other way, and this page was not written to insinuate that something does.

Smallpdf AG is a Swiss company, and it has built what is comfortably the most finished product of the six converters we track — an interface that tells you where you are without being asked. Its privacy notice puts an in brief summary above each section, which is a courtesy to the reader and rarer than it ought to be. The verdict is therefore the easy part of this page. The rest of it concerns one detail sitting underneath that verdict, which secondhand summaries drop every single time.

Is Smallpdf safe for a visitor who never signs in?

The figure that circulates about Smallpdf is one hour. It turns up in forum replies, in comparison round-ups, and in the summaries that sit above the search results you probably came from. It is genuine, it comes from the company’s own notice, and it is not the complete sentence.

The complete sentence attaches a condition first. Deletion inside the hour is introduced with the words “If you access our services via a User Account”. Given that condition, Smallpdf writes that “we delete User Files within one hour” — unless you have deliberately saved a file into your storage, in which case it stays until you remove it, and removal completes “within 14 days”.

Now picture who actually turns up at a free PDF tool. Somebody searches, lands on a page, drags a document in, takes the result, closes the tab. No sign-up. No login. Nothing typed into an account field at any point. That person falls outside the sentence above, and the notice handles them in a separate passage — the one where the clock vanishes. For use without an account, Smallpdf says it will “generally aim to delete User Files” within “a reasonable period of time after the last time they were opened”, noting also that “this retention period is extended every time you reopen the respective User File”.

Set those two passages beside each other and the shape is obvious enough. One commitment is precise, and it belongs to the smaller group. The other has no clock in it, and it belongs to nearly everyone else. Nothing here is concealed: both statements live in the same public document, a few paragraphs apart, and anybody may go and read them. The qualifier is not lost at the source. It is lost downstream, in the retelling.

The rest of the notice, as it stood on August 7, 2026

We went through Smallpdf’s privacy notice in full that day. It signed off with “Last updated: 29 July 2025”, and a document that dates itself is doing something not every policy bothers to do. Everything described here is that document on that day; any of it may be rewritten tomorrow without anyone being told.

Two passages in it deserve credit rather than suspicion.

The first is geography. Instead of waving at “appropriate safeguards” and leaving it there, the notice names the places data can end up — Serbia, and the Philippines for certain support cases — and it names the United States as somewhere “whose level of data protection is generally speaking not considered adequate”. Putting that sentence in print about a country you transfer data to is not the comfortable option, and we would sooner point at it than at anything else on the page.

The second concerns the AI features, where the notice states plainly that “We do not use these files to train models”. Given how many services went quietly the other way over the past two years, a refusal written down is worth something.

Their pricing page separately states that “Smallpdf is ISO/IEC 27001 certified”, meaning an outside body has inspected how they run information security and put its name to the result. Nobody has ever inspected this site that way. We are not going to gesture at anything resembling it.

Their front page, measured rather than assumed

We ran our own check against smallpdf.com on August 7, 2026. It came back with two third-party hosts, fonts.googleapis.com and fonts.gstatic.com, both belonging to Google’s font service. Neither matched the advertising-and-measurement patterns our check flags. Across all six converters that same run produced counts of zero, one, two, three, four and six — and of the five that referenced any outside host at all, Smallpdf was the only one where nothing tripped the tracker patterns.

The method wants stating before that number travels anywhere without it. What gets parsed is the markup exactly as the server delivers it, and what gets tallied is each outside host named inside a tag: scripts, stylesheets, images, frames. Whatever a page assembles afterwards, once its own JavaScript is running, sits beyond anything that parse can observe. So “two” means two statically named third-party hosts in delivered markup. It is not a claim about everything the page eventually requests, and a low number should not be allowed to do work it has not earned.

One point cuts against us as readily as for us, so it belongs here too: a font CDN is not a tracker, but it remains a host that sees the IP address of everyone loading the page. This site serves its fonts from its own origin. That is a difference of degree, not a moral one.

Why the qualifier matters more than the number

Suppose the condition were not there at all, and the hour applied to every visitor equally. It would still be a sentence.

Smallpdf converts on hardware it operates, which is precisely what lets it do the things listed further down this page. It also means a copy of your document lands on equipment outside your control, and everything you subsequently learn about that copy reaches you as a written assurance rather than as an observation. Whether a deletion swept every replica and every backup rotation, who could open the file while it sat there, which subcontractor held the disk that week — none of it surfaces anywhere a visitor is able to look. The pillar page for this cluster lays out what your browser’s Network panel settles for you and where, exactly, it falls silent.

The qualifier is worth noticing, then, not because it conceals a risk. It is worth noticing because it is the portion of the arrangement you are actually able to examine. It is printed. Read it and you have read the best evidence on offer, which is a document. The same held for CloudConvert, where the load-bearing detail turned out to be a button rather than a login.

Where Smallpdf beats a browser tab outright

Here is where we stop being the interesting party.

• Word, Excel and PowerPoint with the layout intact. Smallpdf does this properly. We do not, and the decision was deliberate rather than accidental: pdf to word is among the largest search terms this site could have chased, and it was left unbuilt because producing a .docx that preserves the original layout is not honestly achievable inside a browser tab at the standard people expect. Shipping something that quietly wrecked tables would have earned traffic it did not deserve. If you need that conversion, they have it and we never will.
• OCR. Turning a scan into selectable text requires recognition machinery we do not ship in any form.
• Signing. eSign, with the audit trail that makes a signature mean anything.
• An account that remembers. File history, sync between devices, imports straight out of Google Workspace or Dropbox. There are no accounts here, so none of that is even available to build against.
• Documents larger than your own memory. Server hardware does not run out of RAM the way a tab does.

We run about 55 tools, one conversion per address, every one of them bounded by the machine sitting in front of you.

When keeping the file at home is the better trade

The calculation reverses when three things hold at once: the document is sensitive, it is small enough for your own hardware, and the job itself is ordinary.

A payslip. A rental contract. A letter from a consultant. A scan of a passport. For those, the least eventful option is the one that keeps the document on the desk it started on, where you can see for yourself that it stayed there.

That is what the tools here exist for: PDF to JPG to lift a page out as an image, PDF to text to pull the words out of one, and JPG to PDF or PNG to PDF for the journey back. All four work entirely within the page you are reading, on your own processor, with nothing crossing the network. Not because a Swiss company would handle your tenancy agreement carelessly — but because a file that never travels needs no promise attached to it, conditional or otherwise.