Search for "PDF converter", "HWP viewer" or "open Excel online" and you will find countless free sites. They are convenient, but have you ever thought about where and how they process your file? Uploading a company contract or HR file without thinking can lead to a security incident. This guide explains the two ways web viewers work and how to choose a safe one.
Two ways online document tools work
Server-side processing (upload)
- When you choose a file, the browser sends the whole file to the site's server.
- A conversion program on the server opens the file and turns it into images, HTML or PDF.
- The result is sent back to you.
During this process the original file is stored on someone else's disk, at least for a while. Even if the site promises automatic deletion after an hour, you cannot verify that no copies remain in backups, logs or caches.
Client-side processing (in-browser rendering)
- When you choose a file, the browser reads it only in your computer's memory.
- JavaScript and WebAssembly delivered with the page interpret the file inside the browser and draw it on screen.
- There is no step that sends the file over the network.
InstantDocView uses only the second method. The web page just delivers the program; your document never leaves your device.
Concrete risks of upload-based services
- Unclear retention: you cannot check from outside whether the deletion policy is followed.
- Transfers abroad: if the server is in another country, personal data is effectively transferred abroad, which may break company rules or data protection laws.
- Attack target: a server collecting documents from many users is an attractive target for attackers.
- Use as training data: terms of service sometimes hide clauses allowing data use for "service improvement".
Why client-side rendering is now possible
In the past, browsers were too weak to interpret complex documents. That has changed.
- Faster JavaScript engines and WebAssembly: binary files of several megabytes can be parsed in about a second.
- File API and ArrayBuffer: the browser can read local files byte by byte.
- Web Workers: heavy work such as PDF parsing runs in a separate thread, so the page stays responsive.
- Open-source parsers: publicly reviewed libraries such as docx-preview, SheetJS, PDF.js and rhwp are available.
How to check whether a site uploads your file
- Press F12 in Chrome to open the developer tools.
- Select the Network tab and clear the log.
- Open a file in the site.
- Look for a request (usually POST) roughly the size of your file going to the server.
With client-side processing, no upload request matching your document's size appears. Small requests from ads or analytics may still show up, but they do not carry the document's contents.
Basic rules at work
- Use only tools allowed by your company's security policy.
- Before pasting text into external services, hide ID and phone numbers with the privacy masking tool.
- On shared computers, always close the tab where you opened the document and delete copies from the Downloads folder.
Convenience and security are not opposites. Once you understand how a tool processes files, you can have both.