ream.

The mechanism, not the marketing

A PDF tool should not need a copy of your PDF.

Every file you hand to a web-based PDF tool travels further than the tab you are looking at. This page explains that journey step by step, what replaces it here, and the seven jobs where running in a browser is genuinely the weaker choice. No adjective does the work that a mechanism does.

  • No upload endpoint exists
  • Runs with the network off
  • Four ways to check it yourself

Upload model7 hops

  1. Browser builds a multipart/form-data request and POSTs the bytes
  2. TLS terminates at a load balancer operated by someone else
  3. Bytes are written to temporary object storage
  4. A job record is created: file id, size, your IP, timestamp
  5. A worker reads the file and writes an output file
  6. The tab polls for completion, then fetches a signed URL
  7. Both copies are deleted on a schedule you cannot inspect

Ream model2 hops

  1. Bytes read from your disk into this tab
  2. Result written back to your disk

Five hops removed

Section one

What an upload actually is

The word “upload” compresses a chain of events into two syllables. Spelled out, a server-side PDF tool asks you to accept seven separate statements about someone else’s infrastructure, only one of which you can observe from your own machine.

You can watch the bytes leave. You cannot watch the temporary file being written, the job record being created, the worker reading it, the output being produced, or either copy being deleted. Every one of those steps is a promise, and a promise is not a security control.

This is not an accusation of bad faith. Reputable services do delete files on schedule and publish retention windows. But the window is measurement, not architecture: for the length of it your document exists in a place you have no access to, under an operator who now carries obligations it never asked for. A misconfigured bucket, an over-broad backup policy, a crash dump written at the wrong moment — none of these require anyone to behave badly.

The cheapest way to remove that entire category of risk is to remove the copy. Not encrypt it, not promise to delete it. Never create it.

What each hop costs you

Time
Two full network round trips, plus queue latency.
Data
Upload and download both count against your allowance.
Exposure
A second copy exists for the length of the retention window.
Metadata
Your IP, file name, size and timestamps are logged.
Dependency
No network means no work.

Section two

The browser quietly became a document runtime

The objection to local PDF tools used to be true. In 2012 a browser could not deflate a stream at speed or parse a 40 MB object table without locking the tab. That has changed, and the change is not marketing: each of these is a platform feature with a specification behind it.

WebAssembly

A portable bytecode target with near-native throughput. pdf.js renders pages, Tesseract recognises text, and the PDF writer runs here — no native install.

Web Workers + OffscreenCanvas

Parsing, rasterising and OCR run off the main thread, so the interface stays responsive while a 200-page document renders thumbnails.

CompressionStream

Native deflate, which is exactly the algorithm behind a PDF’s FlateDecode filter. Compression quality no longer depends on a JavaScript zlib port.

Blob, Streams and File API

A 400 MB file can be read in slices and written back as a Blob without ever being copied into a string or base64-encoded.

Web Crypto

Key derivation and random number generation from the platform. The PDF standard security handler, AES-256, is implemented against these primitives.

Service Worker + Cache API

Install the toolset once and the same build runs with the network switched off. Offline behaviour is not a setting; it is a consequence of the architecture.

Section three

A PDF is a data structure, not a picture

A PDF file is a set of numbered objects, a cross-reference table pointing at their byte offsets, a document catalogue, a page tree, and one content stream per page. Text is encoded with embedded font subsets; images are separate streams; annotations and form fields are objects that reference pages.

That structure means structural editing is a graph operation, not a rendering operation. Merging two files parses both object tables, copies objects into one space with renumbered references, splices the two page arrays under a new root, and writes a fresh cross-reference table. No page is ever drawn.

The consequence is worth stating plainly: page content survives byte for byte. Text stays selectable, links stay live, bookmarks and form fields still work, and a scanned signature does not acquire a second generation of JPEG artefacts. Splitting, rotating, reordering, extracting and cropping are the same class of operation.

Rasterising is the exception, and it is confined to the one place it belongs. Compress PDF by re-encoding pages as images and text stops being selectable — that is the trade, it is disclosed before the run, and the output filename says so.

Merge, at the object level

read A.pdf  → objects + xref
read B.pdf  → objects + xref

for each page in B:
  clone page object
  clone its resource refs
  renumber to A's space

/A  << /Count 12  /Kids [...] >>
/AB << /Count 25  /Kids [...] >>

write new xref
→ bytes out, pages untouched

Zero rendering, zero recompression. Two 50 MB files merge in a few hundred milliseconds on a laptop, because the work is copying pointers between two tables in memory.

Section four

The transfer arithmetic

40 s

Transport for one 50 MB file on a 20 Mbit/s connection

20 s up, 20 s down, before any queue time.

0 s

Transport in Ream for the same file

The only copy is disk to RAM, which is measured in milliseconds.

100 MB

Mobile data consumed by a 50 MB round trip

Repeated every time the tool is used, on every file.

Per-request time limits and file-size caps on server-side tools are not arbitrary unfriendliness. They are the direct consequence of paying for bandwidth and worker seconds on every job. Remove the transfer and the reason to meter disappears with it, which is why this site has no daily counter, no premium queue and no file cap of its own.

Section five

Where local genuinely loses

Seven jobs a browser tab cannot do honestly. Each one is stated on the tool page that gets closest to it, rather than buried here.

Office layout fidelity
Word, PowerPoint and Excel need a real layout engine: font shaping, table pagination, chart rendering, floating objects that reflow text. That engine is tens of megabytes of native code and is not in any browser. Ream reconstructs the text structure into PDF and lists what it could not carry. If you need slides that look exactly like slides, a desktop converter is the correct tool.
PDF/A conformance
Ream can write the structure a PDF/A profile asks for: embedded fonts, an output intent, XMP metadata, no encryption. Whether the result conforms is a validation question, and the validator is veraPDF, a separate tool. We tell you what was written and point you at verification rather than stamping a logo on it.
Fetching a URL
Converting a live web page to PDF means an HTTP request, and from a browser tab that request is made from your machine under your IP, subject to CORS. There is no server here to fetch on your behalf, so HTML to PDF converts markup you paste or upload.
Password recovery
Unlock PDF opens a document when you already know the password. It is not a cracking tool and does not brute-force anything. A recovery service that guesses keys is a different product with different costs.
Very large files
Everything lives in memory, and a browser tab is bounded by a per-tab heap and by how much RAM the device physically has. Roughly 300–500 MB per file is comfortable on a modern laptop, considerably less on a phone. A server can stream from disk; a tab cannot.
Certified digital signatures
A drawn or typed signature is an electronic signature, accepted for ordinary contracts. A certificate-backed signature with a tamper-evident seal needs a signing key, a certificate authority and a timestamp authority. Ream does not pretend to be one.
Accessibility remediation
A structure tree can be written, but tagged-PDF conformance for assistive technology is an audit, not an export setting. Anyone claiming otherwise in one click is overstating it.

Section six

Four ways to disbelieve this page

A privacy claim you cannot test is decoration. Every statement above is checkable in under five minutes, without reading any source code.

Security modelOffline test

  1. 01Watch the network panel

    Open developer tools, switch to Network, then process a file. The only requests are same-origin assets that loaded with the page. The download is a blob URL created in memory.

  2. 02Turn the network off

    Load any tool page, then disconnect from the internet or tick “Offline” in the network panel and process the file. It completes. That is not possible if anything is being uploaded.

  3. 03Read the policy the browser enforces

    Every response carries a Content-Security-Policy header with default-src ’self’. Third-party script hosts, analytics beacons and foreign fetch targets are blocked by the browser before any code runs.

  4. 04Search the bundle

    Pull the JavaScript the page shipped and search it for fetch calls and XMLHttpRequest. There is no upload endpoint to find, because none was written.

Compare with the upload sitesChain tools in one passWhy there is no paid tierTry a merge, no upload

The only test that matters

Process the file you would not normally upload.

A passport scan, a payslip, an unsigned contract, a medical letter. If the tool is telling the truth, none of them can go anywhere.

Compress a PDFAll 34 tools
No uploadNo accountNo file limitNo cookies