Is PDF24 Safe in 2026? A Detailed Privacy Review

Short answer: PDF24 is a legitimate German PDF service developed by Geek Software GmbH since 2006, with a clear two-tier model: a web-based toolkit at tools.pdf24.org that uploads files to EU servers and deletes them within one hour, and a free offline desktop app called PDF24 Creator that processes files entirely on your Windows computer. For casual non-sensitive documents, the web tools are acceptable. For confidential material like contracts, medical records, financial statements, or anything regulated, the structural concern is the same as with every cloud PDF tool: your file leaves your device and sits on a third-party server during processing. The offline Creator removes that step for Windows users — but leaves macOS, Linux, iOS, and Android users without a truly local option. A browser-based tool that runs on every device without uploading files fills that gap entirely.

This article walks through how PDF24 actually handles your data in 2026, where the web vs desktop split creates a real gap for non-Windows users, and the alternative architecture that processes PDFs locally in any modern browser.

What PDF24 actually does with your file

PDF24 operates two distinct products with two very different privacy profiles. The distinction matters more than most reviews acknowledge.

PDF24 Tools (web version, tools.pdf24.org):

Your browser uploads the file over HTTPS (SSL/TLS) to PDF24's servers in Germany
The file is processed server-side by the requested tool (merge, compress, OCR, convert, edit, etc.)
The processed file is sent back to your browser for download
The original is automatically deleted from PDF24's servers within one hour of processing
The web interface includes advertising banners, which is how the service stays free

This is a standard cloud PDF architecture. The one-hour deletion window is documented on PDF24's FAQ and is among the shorter retention windows in the industry. Files can also be manually deleted immediately after processing if you log into the service.

PDF24 Creator (desktop version, Windows only):

You download and install the PDF24 Creator on your Windows PC (422 MB installer)
All PDF operations happen locally on your machine — no internet connection required after installation
Files never leave your computer
No upload, no server processing, no retention question

The Creator is also free for personal and commercial use, with no subscription, no watermark, and no usage limits. For Windows users handling sensitive documents, this is the genuinely private option.

The problem: PDF24 Creator does not exist for macOS, Linux, iOS, Android, or ChromeOS. Users on those platforms are pushed toward the web version, which means uploading files to servers.

PDF24's security and compliance posture

PDF24's published security position in 2026 is reasonable by free-SaaS standards:

German company (Geek Software GmbH, Berlin) founded in 2006, operating under EU GDPR jurisdiction
Processing servers located within the EU (Germany)
GDPR compliant as a matter of EU law, with a documented privacy policy
SSL/TLS encryption for all file transfers on the web tools
Automatic one-hour file deletion on processing servers
Explicit non-mining commitment: PDF24 states files are used only for the requested processing task and not analyzed for any other purpose
Microsoft Store distribution for the Creator (automated security screening)
4.4/5 average on Trustpilot across a modest number of reviews
Long-running development history (20 years) is a genuine trust signal for a free tool

There are no public records of major data breaches affecting PDF24 user files. The company is transparent about the distinction between its web tools and its desktop Creator, which is more than most competitors offer.

What PDF24 does not have:

ISO/IEC 27001 certification
SOC 2 attestation
eIDAS Qualified Trust Service Provider status for electronic signatures
HIPAA Business Associate Agreement offering
A macOS, Linux, or mobile version of the offline Creator

For casual and small-business users, the absence of enterprise certifications is not disqualifying. For regulated environments — legal, healthcare, finance — it matters because compliance reviews typically look for exactly those certifications.

Where the cloud model becomes the actual risk

Even with one-hour retention and EU servers, the structural fact remains: when you use PDF24's web tools, your document content leaves your device and exists on a third-party server during processing. For specific document categories, that single fact is the risk regardless of how short the retention window is.

Legal documents

Contracts, NDAs, litigation files, client correspondence, billing records covered by attorney-client privilege. Many law firm engagement letters and professional rules of conduct explicitly forbid transmission of client documents to third-party processors without prior consent or a signed Data Processing Agreement. A one-hour retention window does not change the fact that the document existed on an external server during that window, which is what most professional confidentiality obligations actually prohibit.

Medical records

Patient intake forms, lab results, insurance paperwork. In the US, HIPAA requires a Business Associate Agreement with any vendor processing Protected Health Information, and PDF24's standard free tier is not a BAA. In the EU, special-category health data under GDPR Article 9 has stricter processing requirements that informal upload to a free SaaS tool does not satisfy, even when that tool is itself GDPR compliant.

Financial and tax documents

Tax returns, bank statements, payroll files, crypto statements, brokerage records. These contain account numbers, tax IDs, and identity information with direct fraud value if intercepted, even when encrypted in transit. The shorter the third-party storage window, the better — but zero is better than one hour.

Source code, board materials, internal reports

Board memos, product roadmaps, unreleased financials, source code printouts. The risk here is less regulatory and more competitive: any time confidential business material exists on a third-party server, that copy is one breach, one subpoena, one insider misuse, or one misconfiguration away from exposure.

For these document types, the question shifts from "Is PDF24 safe?" to "Should this document be processed in the cloud at all?" For most professionals handling sensitive material, the answer is no — even when the third party is a legitimate German company with a one-hour retention policy.

The Windows-only gap in PDF24's local story

PDF24's strongest privacy pitch is the offline Creator: install it on your PC, process files locally, nothing uploaded. For Windows users, this is a genuinely private workflow.

But PDF24 is telling only half the story when it frames itself as "local-first." The Creator does not run on:

macOS — over 15% of desktop share globally, higher in creative, legal, and executive roles
Linux — engineers, security professionals, developers
iOS and iPadOS — the most common personal computing platform for millions of professionals
Android — a billion-plus users globally
ChromeOS — increasingly common in schools, non-profits, and travel laptops

For every non-Windows user — which is the majority of PDF24's potential audience by platform count — the only PDF24 option is the web upload path. The "your files stay local" promise disappears the moment you open Safari or Chrome on a Mac, iPhone, or Android device.

This is a real limitation, not a nitpick. A user handling a client NDA on a MacBook has no more privacy using PDF24 than they would using any other cloud PDF service, because for them there is no offline version.

The web interface: free, but ad-supported

Independent of the privacy discussion, PDF24's web interface in 2026 has practical characteristics worth knowing:

Advertising banners on most tool pages (this is how the free service is funded)
Some ads have been described as intrusive in reviews from PCWorld and PDFGear
Requires internet connection for all web tool operations
No account required, which is genuinely friendly
No file size limits or daily caps advertised
Older interface compared to newer competitors, though this has improved through 2025-2026
No real-time collaboration or team features

For users who process PDFs occasionally, the ad-supported free model is a fair trade. For users who work with PDFs constantly, the ads become friction, and for users on restricted networks (corporate, government, educational) the ad domains are sometimes blocked outright, breaking the tools.

How browser-based PDF tools change the model

There is a fundamentally different architecture that has matured significantly since 2023: PDF processing that runs entirely inside your browser using WebAssembly. No upload, no server-side processing, no retention window to worry about, because the document never leaves your device in the first place. This works on every operating system that runs a modern browser — Windows, macOS, Linux, ChromeOS, iOS, and Android.

This is the architecture HonestPDF uses. When you merge, redact, sign, compress, or convert a PDF, all of the processing happens in your browser using the same compute resources that render the page you are reading. There is no upload endpoint for tool files at all. You can verify this directly: open the tool, disconnect from the internet, and the tool keeps working. Try the same with PDF24's web tools and they stop immediately.

The trade-offs are honest. Browser-based tools depend on your device having enough memory for very large files (a 500-page scanned PDF is heavier on a phone than a workstation). For truly advanced operations like enterprise OCR on poor-quality scans or heavy batch conversion of thousands of files, dedicated desktop software still has an edge. But for the everyday privacy-sensitive work like redaction, merging, simple signing, compression, conversion, and basic OCR, the browser-based model removes the entire category of risk that the cloud model creates — on any device.

Side by side: when each approach makes sense

PDF24 is a reasonable choice when:

You are on Windows and willing to install the offline PDF24 Creator for sensitive work
You are processing non-confidential documents (public PDFs, marketing materials, generic files)
You value the depth of a full desktop application with a virtual PDF printer driver
You need specific Creator features like the print-to-PDF workflow across any Windows application
The ad-supported web interface does not bother you for occasional tasks

A browser-based tool like HonestPDF is the safer choice when:

You are on macOS, Linux, iOS, Android, or ChromeOS (no offline PDF24 option exists)
The document is confidential, legally privileged, or regulated
You want a consistent private experience across every device you own
You are on a locked-down work computer where you cannot install desktop software
You want to avoid ads and installation altogether
You simply prefer the documents you process to never leave your device, regardless of the server's policies

Neither approach is universally correct. PDF24 Creator is genuinely a strong offline option for Windows users, and among the most honest free desktop PDF tools available. The question is platform and context: does this specific document, on this specific device, match PDF24's actual privacy model?

A practical workflow recommendation

For most professionals, the cleanest workflow in 2026 looks like this: use a browser-based tool by default for any document containing client data, financial information, health information, or anything covered by an NDA — because it works identically on every device you might be using at the moment. Reserve PDF24 for genuinely public documents on a Windows machine where the Creator is installed, or for the Windows-specific print-to-PDF workflow that Creator handles well.

This avoids the awkward case-by-case question of "am I on a Mac right now, and if so does this file need to be private" and replaces it with a default-safe habit that travels with you.

If you want to test the browser-based approach without changing your habits, pick the next confidential PDF you would have uploaded to PDF24 Tools and process it locally in your browser instead. The output is the same. The exposure is not.

Frequently asked questions

Is PDF24 a scam or malware?

No. PDF24 is developed by Geek Software GmbH, a legitimate German software company founded in 2006 and based in Berlin. The software has over 20 years of development history, is distributed through the Microsoft Store and the official pdf24.org domain, and has clean antivirus scans on major engines. No public reports of malware, adware bundling, or spyware exist for the official installer. The software is genuinely free for both personal and commercial use.

How long does PDF24 keep my files?

For the web tools at tools.pdf24.org, uploaded files are automatically deleted from PDF24's servers within one hour of processing, and users can manually trigger deletion immediately. For the offline PDF24 Creator on Windows, no files are uploaded at all — everything stays on your computer. With a browser-based tool like HonestPDF, the retention question does not apply because no file is ever stored on a server in the first place.

Is PDF24 GDPR compliant?

Yes, as a Germany-based EU company, PDF24 is subject to and compliant with GDPR. The company documents its data handling in its privacy policy and processes files on servers located within the EU. For organizations using the PDF24 web tools under GDPR, you would typically still need to disclose PDF24 as a third-party processor in your own privacy policy. The offline Creator removes that disclosure obligation because it processes files locally without any data transfer to PDF24.

Is PDF24 available for Mac or Linux?

The offline PDF24 Creator is Windows-only and does not have macOS, Linux, iOS, Android, or ChromeOS versions. Mac, Linux, and mobile users only have access to the web tools at tools.pdf24.org, which upload files to PDF24's servers for processing. For privacy-sensitive work on non-Windows devices, a browser-based PDF tool that runs locally in any modern browser — like HonestPDF — offers a truly local experience on every platform.

Has PDF24 ever been hacked?

There is no public record of a major security breach affecting PDF24 user files. Geek Software GmbH has operated PDF24 since 2006 without a known data incident. The most notable security item in public records is a 2023 local privilege-escalation vulnerability in older PDF24 Creator installers (versions ≤ 11.15.1), which was patched in 11.15.2 and affected only users running outdated local installs — not a server-side breach of user documents. Keeping the Creator updated resolves that issue entirely.

Are there ads on PDF24?

The web tools at tools.pdf24.org are ad-supported — this is how the free service is funded. Ads appear as banners around the tool interfaces. Multiple third-party reviews (including PDFGear) describe the ads as intrusive in some contexts, and some corporate or institutional networks block the ad domains, which can break tool functionality. The offline PDF24 Creator for Windows does not contain ads. Browser-based alternatives that run entirely on your device do not serve ads because they do not need ad revenue to run servers.

Is PDF24 safe for legal or medical documents?

The PDF24 web tools are technically secure (SSL encryption, one-hour deletion, EU servers) but for legal and medical documents the relevant question is contractual and regulatory rather than technical. Law firm engagement letters and HIPAA Business Associate Agreements commonly restrict transmission of client or patient documents to third-party SaaS tools without prior written agreement, and PDF24 does not publicly offer a BAA or DPA in its free tier. For these document categories, the offline PDF24 Creator (if on Windows) or a browser-based PDF tool that never transmits the file is the cleaner compliance posture.

Can I use PDF24 offline?

The PDF24 Creator runs fully offline on Windows once installed. The web tools at tools.pdf24.org require an internet connection because processing happens on PDF24's servers. For consistent offline operation on non-Windows devices, you need either a different desktop tool or a browser-based tool that loads once and then runs locally on any operating system.

The bottom line

PDF24 is one of the more honest free PDF services in 2026: a legitimate 20-year-old German company, transparent about the split between its uploading web tools and its local Windows Creator, with a one-hour retention window that is shorter than most competitors. For Windows users with non-sensitive documents, it is a solid choice. For Windows users with sensitive documents, the offline Creator is a genuinely private option worth installing.

But the privacy story has a real gap: on macOS, Linux, iOS, Android, or ChromeOS, PDF24 offers no offline path — the web tools are all you get, and those upload your files to servers. For the majority of devices in circulation today, PDF24 is a cloud tool with ads, not a local one.

If you handle confidential PDFs regularly and use anything other than Windows, the practical move is to default to a tool that never uploads your files on any platform, and reserve cloud services for the documents where you genuinely do not care who else might see them.

Try HonestPDF's privacy-first PDF tools — every tool runs entirely in your browser, works on every operating system, with no uploads, no accounts, no ads, and no daily limits.

Related Privacy Reviews

If you are exploring different PDF software and their privacy policies, you might also find our other security breakdowns helpful: