Are Online Image & File Converters Safe? What the FBI Warning Means

Mostly yes — reputable online converters are not out to get you. But uploading a file creates three real risk classes: outright malicious fake converters, breach exposure at legitimate services, and retention windows where your file sits on someone else's server. There is also a category of tool that removes all three: converters that process entirely in your browser, so nothing uploads.

Risk 1: The FBI warning about fake converters

In March 2025, the FBI's Denver field office issued a public warning about free online file converter tools. The advisory described scammers standing up convincing-looking converter sites that do perform the conversion you asked for — but that also deliver malware in the returned file, or scrape personal information out of the documents people upload.

The detail that makes this effective is that the tool works. You get your converted PDF or JPEG back, so nothing looks wrong. Meanwhile the returned file may carry a payload, and the document you handed over — which for a converter is very often a résumé, a bank statement, a scanned ID, or a signed contract — has been read by someone whose business model is reading it.

You can read the advisory directly: FBI Denver warns of online file converter scam.

This is the loudest risk, and also the easiest to reason about. It is a scam category, not an indictment of the whole industry. The well-known converters are not doing this. But a search result for "convert PDF to Word free" does not tell you which bucket a site falls into.

Risk 2: Breach surface — the 89,000-document exposure

The second risk has nothing to do with bad intent. In 2025, researchers at Cybernews reported that two PDF utilities — PDF Pro and Help PDF — had left user-uploaded documents publicly accessible through misconfigured cloud storage. The exposed set ran to more than 89,000 files and reportedly included passports, identity documents, and contracts.

Nobody set out to leak those documents. Somebody set a storage bucket's permissions wrong. That is the ordinary way data gets exposed, and it is worth being precise about the lesson: the failure was a configuration mistake, but the reason there was anything to expose is that the files had been uploaded in the first place.

That is the structural point of this whole article. A misconfiguration can only leak files that exist on a server. Every upload adds one more copy of your document to one more system that can be misconfigured, breached, subpoenaed, or sold in an acquisition. Reducing the number of copies is the only control you fully own.

Risk 3: Retention windows at services doing everything right

Even the legitimate, well-run services have a window during which your file exists on their infrastructure. They are generally upfront about it. Based on their published policies:

• remove.bg deletes uploads within roughly an hour, storing images up to 60 minutes to complete processing.
• TinyPNG retains uploaded files temporarily and removes them after processing.
• iLovePDF states that files are deleted within about two hours.
• Smallpdf states that files are removed after about an hour.

These are short windows and these are reputable companies. This section is not an accusation — it is arithmetic. Whatever the number is, for that period your passport scan or your client contract is sitting on hardware you do not control, governed by a policy that can change, in a jurisdiction that may not be yours. If the file is a holiday snapshot, that is a fine trade. If it is a signed NDA or a photo of a child, you may want the window to be zero.

How to verify any tool in 60 seconds

You do not have to take anyone's marketing copy on faith, including ours. Every browser ships with the instrument you need.

1. Open DevTools and select the Network tab. Press F12 (or Cmd+Option+I on macOS), click Network, and leave the panel open. Optionally click the clear button so you start from an empty list.
2. Run the tool on a test image. Use a throwaway file, not the sensitive document. Load it, convert it, download the result — the full workflow.
3. Look for POST or upload requests. Sort or filter the request list and look at the method column. A genuinely client-side tool sends no request containing your file: you will see the page's own HTML, CSS, JavaScript and fonts load, and then nothing further while you work. A server-side tool will show a POST (or PUT) carrying a multipart body with your filename in it.
4. Bonus: turn off Wi-Fi after the page loads. This is the version that needs no technical vocabulary at all. Load the page, disconnect from the network, then use the tool. If it still converts your file and still lets you download the result, the processing was happening on your machine. If it hangs or errors, your file was going somewhere.

The offline test is the one to remember. It is unfakeable — a server-side tool cannot pass it, and a client-side tool cannot fail it.

So what should you actually do?

Nothing here says "never use an online converter." It says match the tool to the file. For a meme, use whatever ranks first. For anything with a name, an address, an account number, a signature, or a face you are responsible for, prefer a tool that does not upload — and spend the sixty seconds to confirm that it doesn't.

The three risks above are not equally likely, but they share a single root cause. Malicious converters need your file. Misconfigured buckets need your file. Retention windows need your file. Client-side processing is not a stronger promise than the others — it is the absence of the thing all three depend on.