Written by the mergepdf.dev Team · All guides · Updated April 2026
When you use mergepdf.dev, your PDF files never leave your device. That's not a marketing claim — it's a technical fact. Here's exactly how it works.
Step 1 — The File API reads your PDFs locally
When you select PDF files, your browser uses the File API — a standard web technology built into every modern browser. The File API lets JavaScript read files from your device's storage directly into the browser's memory (RAM). No network request is made. The files load locally, the same way a desktop app would read them.
This is the key difference from upload-based tools. They use a form submission or XMLHttpRequest to send your files to their server. This tool uses the File API to read files locally. The distinction is fundamental — one sends data over the network, the other doesn't.
Step 2 — pdf-lib processes everything in your browser
Once your PDFs are in memory, the pdf-lib library takes over. pdf-lib is an open-source JavaScript library (MIT licensed, available on GitHub) that can create, read, modify, and merge PDF files entirely in JavaScript. It was designed to run in browsers — no server required.
Here's what pdf-lib does during a merge:
- Parses each PDF's binary structure to understand its format
- Reads the page tree — the internal structure that defines pages
- Extracts each page as a PDF object, preserving fonts, images, and layout
- Creates a new empty PDF document in memory
- Copies pages from each source PDF into the new document, in your chosen order
- Serializes the new document back to binary PDF format
All of this happens in your browser's JavaScript engine. On a modern computer, merging a few PDFs takes 1-5 seconds. Larger files take longer because there's more data to process, but the process is the same. If you're working with large files, our merge large PDF tool has tips for handling 100MB+ documents.
Step 3 — The merged PDF downloads directly from memory
After pdf-lib creates the merged document in memory, the browser converts it to a Blob (Binary Large Object) — a way of representing binary data in JavaScript. Then it creates a temporary download URL pointing to that Blob and triggers a download. The file goes from your browser's RAM directly to your device's storage.
No server is involved at any point. The merged PDF never exists anywhere except your device's memory and then your local storage. This is why tools like this are called "client-side" — everything happens on the client (your device), not on a server.
Why this is safer than upload-based tools
Upload-based PDF tools have an inherent security model: your files travel over the internet, sit on their servers during processing, and then get sent back. Even with HTTPS encryption and promises to delete files, several risks exist:
- Server breaches: If their server is compromised, your files could be exposed
- Retention policies: "We delete after 1 hour" is a promise, not a guarantee
- Legal requests: Servers can be subpoenaed; your device can't be remotely accessed
- Misconfiguration: Cloud storage misconfigurations have exposed millions of files
- Employee access: Server-side processing means employees could theoretically access files
With local processing, none of these risks exist. Your files never leave your device. This is why professionals handling sensitive documents — legal, medical, financial — should use local PDF processing rather than upload-based tools.
How to verify it yourself
You don't have to take our word for it. Here's how to verify that no files are uploaded:
- Open mergepdf.dev in your browser
- Press F12 (Windows) or Cmd+Option+I (Mac) to open Developer Tools
- Click the Network tab
- Select some PDF files and click Merge
- Watch the network requests — you'll see the initial page load, then nothing
No POST requests. No file uploads. No API calls. The network tab stays quiet during the entire merge. This is the same test IT security teams use to audit tools before approving them for internal use.
Does it work offline?
Yes. Once the page loads, it caches in your browser. You can disconnect from the internet and continue merging PDFs. The pdf-lib library is already in your browser's cache — no internet needed to run it. This makes it perfect for merging PDFs offline on flights or in remote locations.
Browser compatibility
The File API and modern JavaScript are supported in all current browsers:
- Chrome/Edge 90+ — Full support, best performance
- Firefox 88+ — Full support
- Safari 14+ — Full support (important for iPhone/iPad users)
- Chrome for Android — Full support
- Safari for iOS — Full support
Works on Mac, Windows, iPhone, and Android — any device with a modern browser.
Ready to try it?
Now that you understand how it works, go merge some PDFs. It's free, takes about 10 seconds, and your files never leave your device.