How to merge PDF files privately without uploading your documents

Why the privacy question matters for PDFs

PDFs are often more sensitive than their filenames suggest. A packet called application.pdf may contain identity documents, bank statements, signatures, medical records, invoices, contracts, school records, or internal reports. A conventional online merger must receive those bytes before its server can combine them. Encryption in transit protects the connection, but it does not change the fact that the service receives the document.

That architecture creates questions most people cannot answer from the upload screen: Where is the file processed? How long is it retained? Is it copied into logs, backups, malware scanners, or analytics systems? Which employees and subprocessors can access it? A deletion promise can be sincere and still be unnecessary exposure for a task a browser can perform locally.

Local processing changes the trust boundary. The page code still needs to be trustworthy, but the PDF itself does not need to cross the network.

Merge PDFs locally with FileGizmo

1. Put the source PDFs in the sequence you want. Rename them 01-cover.pdf, 02-report.pdf, and so on if your file picker sorts by name.
2. Open the FileGizmo Merge PDF tool.
3. Choose two or more unlocked PDF files. FileGizmo uses the order supplied by the browser’s file picker, so select carefully; the current tool does not provide page-thumbnail reordering.
4. Confirm the file count and start the merge. Processing runs in a dedicated browser worker so the interface remains responsive.
5. Review the reported page count and output size, then download the new PDF.
6. Open the result and check the first page, every boundary between source documents, and the final page before deleting or sending anything.

There is no upload-size policy because there is no upload. Large jobs are still constrained by available memory. Hundreds of scanned, image-heavy pages can exceed a phone browser’s practical memory even when the same page count of text-first PDFs works comfortably on a desktop.

What “preserves quality” actually means

A bad PDF workflow renders each page into a bitmap and builds a new document from those pictures. That can make text unselectable, enlarge files, soften vector diagrams, remove searchability, and damage accessibility.

FileGizmo instead creates a new PDF and copies pages from each source document using the copyPages operation documented by pdf-lib. Existing page dimensions and page content are brought into the destination. Text remains text, vector paths remain vector paths, and embedded images are not intentionally recompressed merely because the files were joined.

The output size can still differ from the sum of its inputs. A new PDF has a new object structure, cross-reference data, and serialization overhead. Shared resources may be represented differently. “No rasterization” is the accurate promise; “the output will be byte-identical” is not.

Document-level features need separate checking

A PDF is more than a stack of pages. It can contain document outlines or bookmarks, attachments, portfolios, forms, JavaScript actions, accessibility structure, comments, and cryptographic signatures. Page copying does not guarantee every document-level relationship will be rebuilt in the new file.

Treat these cases carefully:

• Digital signatures: the merged PDF is a new document. A signature that certified a source file does not certify the newly assembled output. Preserve signed originals.
• Bookmarks and attachments: verify them explicitly; do not assume a page merge recreates the source documents’ navigation trees or embedded files.
• Interactive forms: test fields in the result. Identically named fields from separate PDFs can conflict in some merging workflows.
• Tagged PDFs: if accessibility structure is legally or operationally important, audit the output with a suitable PDF accessibility checker.
• Encrypted PDFs: unlock them only when you own the document or have permission. The merger expects readable source files.

If the job is a court filing, regulated record, archival package, or signed contract set, keep the source documents and validate the result with the receiving organization’s rules.

How to verify that a merger is not uploading files

Open your browser’s developer tools, choose Network, clear the existing log, then select and merge a harmless test PDF. Look for a POST, PUT, fetch, or XHR request whose timing and size correspond to the file. A local tool may download its own worker code after you show intent; that is code coming to the browser, not the document going to a server.

FileGizmo’s processing request count stays at zero because the selected PDF bytes are handed to a worker on the same page. You can inspect this yourself rather than relying only on the privacy copy.

Before sharing the combined PDF

Merging does not sanitize content. It does not remove PDF metadata, redact text, flatten comments, erase hidden layers, or delete attachments. It simply assembles pages. Search the finished file for names or terms you expected to remove, review document properties, and use a true redaction workflow for sensitive content. Drawing a black rectangle over text is not reliable redaction if the underlying text remains selectable.

Use a clear output filename, keep the unlocked or signed sources where appropriate, and send only the reviewed result. Privacy during processing is one part of a safe document workflow; correctness at the moment of sharing is the other.