Is PDF24 Safe in 2026? A Detailed Privacy Review

Short answer: PDF24 is a legitimate German PDF service, a project of geek software GmbH developed since 2006, with a clear two-tier model: a web-based toolkit at tools.pdf24.org that uploads files to EU servers and deletes them within one hour, and a free offline desktop app called PDF24 Creator that processes files entirely on your Windows computer. For casual non-sensitive documents, the web tools are acceptable. For confidential material like contracts, medical records, financial statements, or anything regulated, the structural concern is the same as with every cloud PDF tool: your file leaves your device and sits on a third-party server during processing. The offline Creator removes that step for Windows users - but leaves macOS, Linux, iOS, and Android users without a truly local option. A browser-based tool that runs on every device without uploading files fills that gap entirely.

This article walks through how PDF24 actually handles your data in 2026, where the web vs desktop split creates a real gap for non-Windows users, and the alternative architecture that processes PDFs locally in any modern browser.

What PDF24 actually does with your file

PDF24 operates two distinct products with two very different privacy profiles. The distinction matters more than most reviews acknowledge.

PDF24 Tools (web version, tools.pdf24.org):

Your browser uploads the file over an SSL-secured connection to PDF24's servers, which its tool pages say are located in Germany
The file is processed server-side by the requested tool (merge, compress, OCR, convert, edit, etc.)
The processed file is sent back to your browser for download
The original is automatically deleted from PDF24's servers within one hour of processing
The web interface includes advertising banners, which is how the service stays free

This is a standard cloud PDF architecture, and PDF24's terms of use describe it in those words: documents are uploaded to the provider's server and processed there. The one-hour deletion window is documented on PDF24's FAQ and is among the shorter retention windows in the industry. The privacy policy adds one caveat: storage can run longer if a job itself takes more than an hour. PDF24 says files can also be removed manually right away, and no account is needed for that or for anything else.

PDF24 Creator (desktop version, Windows only):

You download and install the PDF24 Creator on your Windows PC (the full installer was over 400 MB when we checked in September 2026)
All PDF operations happen locally on your machine - no internet connection required after installation
Files never leave your computer
No upload, no server processing, no retention question

The Creator is also free for personal and commercial use, with no subscription and, in PDF24's words, without any restrictions. For Windows users handling sensitive documents, this is the genuinely private option.

The problem: PDF24 Creator does not exist for macOS, Linux, iOS, Android, or ChromeOS. Users on those platforms are pushed toward the web version, which means uploading files to servers.

PDF24's security and compliance posture

PDF24's published security position in 2026 is reasonable by free-SaaS standards:

German company (geek software GmbH, registered in Berlin), operating under EU GDPR jurisdiction; the PDF24 project dates from 2006
Processing servers located within the EU (Germany)
Subject to the GDPR as a German company, with a privacy policy written to it
A data processing agreement (DPA) for the online tools, available on request according to the FAQ
SSL-secured file transfers on the web tools
Automatic one-hour file deletion on processing servers
Explicit non-mining commitment: PDF24 states files are used only for the requested processing task and not evaluated for any other purpose
Microsoft Store distribution for the Creator, alongside the download on pdf24.org
Long-running development history (20 years) is a genuine trust signal for a free tool

We found no public report of a breach of PDF24 user files when we checked in September 2026. The company is transparent about the distinction between its web tools and its desktop Creator, which is more than most competitors offer.

What PDF24's site does not mention (as of September 2026):

ISO/IEC 27001 certification
SOC 2 attestation
eIDAS Qualified Trust Service Provider status for electronic signatures
HIPAA Business Associate Agreement offering

And one thing it states outright: there is no macOS or Linux version of the offline Creator.

For casual and small-business users, the absence of published enterprise certifications is not disqualifying. For regulated environments - legal, healthcare, finance - it matters because compliance reviews typically look for exactly those certifications.

Where the cloud model becomes the actual risk

Even with one-hour retention and EU servers, the structural fact remains: when you use PDF24's web tools, your document content leaves your device and exists on a third-party server during processing. For specific document categories, that single fact is the risk regardless of how short the retention window is.

Legal documents

Contracts, NDAs, litigation files, client correspondence, billing records covered by attorney-client privilege. Many law firm engagement letters and professional rules of conduct explicitly forbid transmission of client documents to third-party processors without prior consent or a signed Data Processing Agreement. A one-hour retention window does not change the fact that the document existed on an external server during that window, which is what most professional confidentiality obligations actually prohibit.

Medical records

Patient intake forms, lab results, insurance paperwork. In the US, HIPAA requires a Business Associate Agreement with any vendor processing Protected Health Information, and PDF24's site does not mention one. In the EU, special-category health data under GDPR Article 9 has stricter processing requirements that informal upload to a free SaaS tool does not satisfy, even when that tool is itself GDPR compliant.

Financial and tax documents

Tax returns, bank statements, payroll files, crypto statements, brokerage records. These contain account numbers, tax IDs, and identity information with direct fraud value if intercepted, even when encrypted in transit. The shorter the third-party storage window, the better - but zero is better than one hour.

Source code, board materials, internal reports

Board memos, product roadmaps, unreleased financials, source code printouts. The risk here is less regulatory and more competitive: any time confidential business material exists on a third-party server, that copy is one breach, one subpoena, one insider misuse, or one misconfiguration away from exposure.

For these document types, the question shifts from "Is PDF24 safe?" to "Should this document be processed in the cloud at all?" For most professionals handling sensitive material, the answer is no - even when the third party is a legitimate German company with a one-hour retention policy.

The Windows-only gap in PDF24's local story

PDF24's strongest privacy pitch is the offline Creator: install it on your PC, process files locally, nothing uploaded. For Windows users, this is a genuinely private workflow.

But that offline option covers Windows only, and PDF24 says so itself: its FAQ tells users of other operating systems to keep using the online tools. The Creator does not run on:

macOS - over 15% of desktop share globally, higher in creative, legal, and executive roles
Linux - engineers, security professionals, developers
iOS and iPadOS - the most common personal computing platform for millions of professionals
Android - a billion-plus users globally
ChromeOS - increasingly common in schools, non-profits, and travel laptops

For every non-Windows user - which is the majority of PDF24's potential audience by platform count - the only PDF24 option is the web upload path. The "your files stay local" promise disappears the moment you open Safari or Chrome on a Mac, iPhone, or Android device.

This is a real limitation, not a nitpick. A user handling a client NDA on a MacBook has no more privacy using PDF24 than they would using any other cloud PDF service, because for them there is no offline version.

The web interface: free, but ad-supported

Independent of the privacy discussion, PDF24's web interface in 2026 has practical characteristics worth knowing:

Advertising banners on most tool pages (this is how the free service is funded; PDF24 calls it "discreet advertising")
The ads are served through Google AdSense, which the privacy policy says sends data including your IP address to Google in the United States
Requires internet connection for all web tool operations
No account required, which is genuinely friendly
No file size limits or daily caps advertised: PDF24's own line is "no artificial limits"
Older-feeling interface compared to newer competitors, in our view
No real-time collaboration or team features that we could find

For users who process PDFs occasionally, the ad-supported free model is a fair trade. For users who work with PDFs constantly, the ads can become friction.

How browser-based PDF tools change the model

There is a fundamentally different architecture that has matured significantly since 2023: PDF processing that runs entirely inside your browser using WebAssembly. No upload, no server-side processing, no retention window to worry about, because the document never leaves your device in the first place. This works on every operating system that runs a modern browser - Windows, macOS, Linux, ChromeOS, iOS, and Android.

This is the architecture HonestPDF uses. When you merge, redact, sign, compress, or convert a PDF, all of the processing happens in your browser using the same compute resources that render the page you are reading. There is no upload endpoint for tool files at all. You can verify this directly: open the tool, disconnect from the internet, and the tool keeps working. PDF24's web tools cannot do that, because by PDF24's own description they process files on its servers.

The trade-offs are honest. Browser-based tools depend on your device having enough memory for very large files (a 500-page scanned PDF is heavier on a phone than a workstation). For truly advanced operations like enterprise OCR on poor-quality scans or heavy batch conversion of thousands of files, dedicated desktop software still has an edge. But for the everyday privacy-sensitive work like redaction, merging, simple signing, compression, conversion, and basic OCR, the browser-based model removes the entire category of risk that the cloud model creates - on any device.

Side by side: when each approach makes sense

PDF24 is a reasonable choice when:

You are on Windows and willing to install the offline PDF24 Creator for sensitive work
You are processing non-confidential documents (public PDFs, marketing materials, generic files)
You value the depth of a full desktop application with a virtual PDF printer driver
You need specific Creator features like the print-to-PDF workflow across any Windows application
The ad-supported web interface does not bother you for occasional tasks

A browser-based tool like HonestPDF is the safer choice when:

You are on macOS, Linux, iOS, Android, or ChromeOS (no offline PDF24 option exists)
The document is confidential, legally privileged, or regulated
You want a consistent private experience across every device you own
You are on a locked-down work computer where you cannot install desktop software
You want to avoid ads and installation altogether
You simply prefer the documents you process to never leave your device, regardless of the server's policies

Neither approach is universally correct. PDF24 Creator is genuinely a strong offline option for Windows users, and among the most honest free desktop PDF tools available. The question is platform and context: does this specific document, on this specific device, match PDF24's actual privacy model?

A practical workflow recommendation

For most professionals, the cleanest workflow in 2026 looks like this: use a browser-based tool by default for any document containing client data, financial information, health information, or anything covered by an NDA - because it works identically on every device you might be using at the moment. Reserve PDF24 for genuinely public documents on a Windows machine where the Creator is installed, or for the Windows-specific print-to-PDF workflow that Creator handles well.

This avoids the awkward case-by-case question of "am I on a Mac right now, and if so does this file need to be private" and replaces it with a default-safe habit that travels with you.

If you want to test the browser-based approach without changing your habits, pick the next confidential PDF you would have uploaded to PDF24 Tools and process it locally in your browser instead. The output is the same. The exposure is not.

Frequently asked questions

Is PDF24 a scam or malware?

No. PDF24 is a project of geek software GmbH, a legitimate German software company based in Berlin, and has been developed since 2006. The software has 20 years of development history and is distributed through the Microsoft Store and the official pdf24.org domain. PDF24 describes the Creator as "100% free of spyware", and we found no public report of malware or adware bundling in the official installer when we checked in September 2026. The software is genuinely free for both personal and commercial use.

How long does PDF24 keep my files?

For the web tools at tools.pdf24.org, uploaded files are automatically deleted from PDF24's servers within one hour of processing (longer only if the job itself runs past an hour, per the privacy policy), and users can manually trigger deletion immediately. For the offline PDF24 Creator on Windows, no files are uploaded at all - everything stays on your computer. With a browser-based tool like HonestPDF, the retention question does not apply because no file is ever stored on a server in the first place.

Is PDF24 GDPR compliant?

As a Germany-based EU company, PDF24's operator is subject to the GDPR, and its privacy policy is written to it. Whether any company is compliant is something only a regulator can settle, but the published facts are the ones that matter here: the company documents its data handling in its privacy policy and processes files on servers located within the EU. For organizations using the PDF24 web tools under GDPR, you would typically still need to disclose PDF24 as a third-party processor in your own privacy policy, and PDF24 says a data processing agreement is available on request. The offline Creator removes that disclosure obligation because it processes files locally without any data transfer to PDF24.

Is PDF24 available for Mac or Linux?

The offline PDF24 Creator is Windows-only and does not have macOS, Linux, iOS, Android, or ChromeOS versions. Mac, Linux, and mobile users only have access to the web tools at tools.pdf24.org, which upload files to PDF24's servers for processing. For privacy-sensitive work on non-Windows devices, a browser-based PDF tool that runs locally in any modern browser - like HonestPDF - offers a truly local experience on every platform.

Has PDF24 ever been hacked?

We found no public report of a security breach affecting PDF24 user files when we checked in September 2026. The most notable security item in public records is a 2023 local privilege-escalation vulnerability in the PDF24 Creator's MSI installer (CVE-2023-49147), which PDF24's changelog records as fixed in version 11.15.2 in December 2023. It concerned local installs - not a server-side breach of user documents. Keeping the Creator updated resolves that issue entirely.

Are there ads on PDF24?

The web tools at tools.pdf24.org are ad-supported - this is how the free service is funded. Ads appear as banners around the tool interfaces. PDF24 describes them as discreet, and its privacy policy names Google AdSense as the ad service. The offline PDF24 Creator for Windows works without uploading your files. Browser-based alternatives that run entirely on your device do not serve ads because they do not need ad revenue to run servers.

Is PDF24 safe for legal or medical documents?

The PDF24 web tools are technically secure (SSL encryption, one-hour deletion, EU servers) but for legal and medical documents the relevant question is contractual and regulatory rather than technical. Law firm engagement letters and HIPAA Business Associate Agreements commonly restrict transmission of client or patient documents to third-party SaaS tools without prior written agreement, and while PDF24 says a data processing agreement for the online tools is available on request, its site does not mention a BAA. For these document categories, the offline PDF24 Creator (if on Windows) or a browser-based PDF tool that never transmits the file is the cleaner compliance posture.

Can I use PDF24 offline?

The PDF24 Creator runs fully offline on Windows once installed. The web tools at tools.pdf24.org require an internet connection because processing happens on PDF24's servers. For consistent offline operation on non-Windows devices, you need either a different desktop tool or a browser-based tool that loads once and then runs locally on any operating system.

Ready to switch?

If you have read this far and decided you would rather your files not leave your device, the next question is usually how the tools compare side by side. We built a detailed feature-by-feature comparison covering platform support, upload behavior, and where each tool fits: HonestPDF vs PDF24.

The bottom line

PDF24 is one of the more honest free PDF services in 2026: a legitimate German company with 20 years of work on the product, transparent about the split between its uploading web tools and its local Windows Creator, with a one-hour retention window that is shorter than most competitors. For Windows users with non-sensitive documents, it is a solid choice. For Windows users with sensitive documents, the offline Creator is a genuinely private option worth installing.

But the privacy story has a real gap: on macOS, Linux, iOS, Android, or ChromeOS, PDF24 offers no offline path. The web tools are all you get, and those upload your files to servers. For the majority of devices in circulation today, PDF24 is a cloud tool with ads, not a local one.

If you handle confidential PDFs regularly and use anything other than Windows, the practical move is to default to a tool that never uploads your files on any platform, and reserve cloud services for the documents where you genuinely do not care who else might see them.

Try HonestPDF's privacy-first PDF tools, every tool runs entirely in your browser, works on every operating system, with no uploads, no accounts, no ads, and no daily limits.

Related Privacy Reviews

If you are exploring different PDF software and their privacy policies, you might also find our other security breakdowns helpful: