Smallpdf
Browser PDF toolkit with 30+ tools and a Pro subscription, built in Switzerland.
Where your files are processed
Reported to upload your files
The vendor states that files are uploaded to their servers. We have not independently tested this. This covers the web service. We have not checked desktop app processing, and we do not extend the finding to it.
Smallpdf's privacy notice describes files being uploaded to its servers rather than processed in the page, so this is a cloud service and the note is the vendor's own. RETENTION IS NOW SCOPED RATHER THAN BLANKET, and the scope depends on the case: with an account, uploaded files are deleted within one hour unless you save them to your own file storage, and a saved file is deleted within 14 days of you asking for it to go; without an account, or whenever you are not signed in, there is no fixed period at all, only a deletion within a reasonable time after the file was last opened, and that clock restarts every time the file is reopened. Somebody asked to sign a document through the eSign tool is in the second group. WHERE THE FILES ARE: uploaded files are processed on Hetzner servers in the European Union, and the notice states this is not permanent storage. Smallpdf is a Swiss company and Switzerland holds an EU adequacy decision, but the notice permits transfers of personal data outside Switzerland and the EEA, naming Serbia and, for some support cases, the Philippines, with standard contractual clauses as the safeguard.
What it does
Smallpdf is a hosted web service bundling over thirty PDF utilities — compress, convert, merge, split, edit text, OCR, redact, sign and password protection — behind one browser interface, plus a Windows app and iOS and Android apps. Your file is uploaded to Smallpdf's servers, processed there, and the result downloaded again. The free plan uses the same tools but caps downloads per day; Pro at £9 a month removes those limits and adds strong compression, OCR and the AI-powered tools.
Best for: People who want a broad, well-supported PDF toolkit that works on any device with nothing installed, and who are comfortable with cloud processing.
Worth knowing: Using a web tool uploads the file to Smallpdf's servers to be processed, so the answer for a confidential document depends on the policy of the organisation holding it rather than on a blanket rule. By default, a document you process is reachable by anyone holding its unique sharing link, which the notice says the user can turn off — check that before processing anything confidential. The free tier is capped by daily download limits on most tools rather than by watermarks. The AI tools add their own 50 MB file cap on every plan.
Details, and where each comes from
Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.
- Versions covered
- Web · Windows · iOS · Android
- Website
- smallpdf.com
- Requires an account
- No
- Free tier
- Yes
- Watermark on the free tier
- Not verified
- Maximum file size
- Not verified
- Batch processing
- Yes
- Data residency
- Multiple regions
- Open source
- Not verified
- Self-hostable
- Not verified
- Licence
- Not verified
- Redaction
- Removes the content
- Programmatic access
- None
- Last availability check
- Responded in 118 ms 16 October 2026
Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.
What the redaction verdict rests on
Tested by us on 17 September 2026, on our own canary document rather than read off a product page.
What that does not establish: Tested on the web tool with our own canary document. It deletes the marked text from the page structure. The vendor does not document a separate desktop or tier behaviour we can speak to.
What the vendor says
Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded — not that we tested the behaviour, unless the note says we did.
-
“Trusted by 1.7 billion people since 2013.”
Checked by us — the source says this Read 21 September 2026
Confirmed verbatim: the page reads "All the PDF tools you need. Built in Switzerland. Trusted by 1.7 billion people since 2013." It is the vendor's own figure and it is attributed to them. What the number counts is not stated — whether people, sessions, documents or visits — and no method or independent audit is published, so we have not verified it and cannot say what it measures. That is the whole of it.
Standing: Re-read and matched byte for byte
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- aade39b1f6a681adcd12013e1aad50ed554155142c4daa6c6edf6c50a3371e21
How we checked: Same page and same read as the Smallpdf ISO 27001 claim verified earlier in this campaign: https://smallpdf.com/pricing rendered in headless Chrome on 2026-09-21, visible text 6274 bytes. sourceHash is the SHA-256 of the rendered text.
-
“Smallpdf is ISO/IEC 27001 certified and GDPR, CCPA and nFADP compliant.”
Checked by us — the source says this Read 21 September 2026
Confirmed verbatim: "Smallpdf is ISO/IEC 27001 certified, GDPR, CCPA, and nFADP compliant." The sentence continues with a security statement the claim omits and which belongs with it: "Thanks to our TLS encryption technology, your documents are always processed with an added layer of security." That is transport encryption, and it says nothing about storage at rest or about who can read a file on the servers, so a reader should not take the compliance sentence and the encryption sentence together as a description of the same guarantee. The four named frameworks are again of two kinds: ISO/IEC 27001 is an auditable certification, while GDPR, CCPA and nFADP are data protection laws that an organisation complies with. No certification body, certificate number or audit date is given on the pricing page, and nothing here was independently verified. Recorded as the vendor's assertion.
Standing: Re-read and matched byte for byte
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- aade39b1f6a681adcd12013e1aad50ed554155142c4daa6c6edf6c50a3371e21
How we checked: https://smallpdf.com/pricing rendered in headless Chrome with scripts/render-page.mjs on 2026-09-21 (visible text 6274 bytes) and the claim checked against that text. sourceHash is the SHA-256 of the rendered text.
-
“Permanently remove sensitive information from your documents with our free PDF redaction tool.”
Checked by us — the source says this Read 22 September 2026
The marked string is GONE from the saved file, while the lines 40pt above and below it survived and so did the untouched second page — so the removal is localised rather than a whole-page flattening. The output contains zero image XObjects, so nothing was rasterised: the marked text is deleted from the page structure. This confirms a `removes_content` verdict that had rested on the vendor's own wording, and it is the direction of error that matters most, because a wrong "removes" tells a reader their redacted document is safe when the text is still inside it. Scope: the web tool, one document, one date.
Standing: Re-read and matched byte for byte
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- a35d645e6b39d2b7cced81e9ff19a7c57951610c0d49950b0a0279bea39ff780
How we checked: Re-verified verbatim on 2026-09-22: https://smallpdf.com/redact-pdf re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-17. sourceHash is the SHA-256 of the re-rendered text, held as rv-smallpdf-com-redact-pdf-eafa0ed2.txt.
Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked — it is not a judgement about anyone.
Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.
Related reading
- Which PDF tools really redact — which tools remove the content rather than cover it.
Compared head to head
- Smallpdf vs iLovePDF The two biggest browser PDF toolkits, both of which upload your files.
- Smallpdf vs Sejda Two browser toolkits that both upload your file, at very different prices.
Alternatives to Smallpdf
What to use instead of Smallpdf The tools in this index that do the same jobs, and what separates them.