Are online document scanners safe? What to check
Published September 1, 2026 · Updated September 26, 2026
Documents are among the most sensitive files people handle — contracts, IDs, medical records, payslips. So the caution is justified: when a website offers to "scan" or "convert" your document, where does the file actually go? The answer separates online scanners into two very different categories, and there are simple tests to tell them apart.
Server-side vs browser-side tools
Most classic web converters upload your file to their server, process it there, and send back the result. Your document then exists — at least temporarily — on infrastructure you know nothing about, governed by a privacy policy you probably did not read. Browser-side tools work differently: the page ships the processing code to your device, and the computation runs locally. The file never crosses the network at all.
Server-side is not automatically evil — reputable services delete uploads on a schedule and say so. But "we delete your files after one hour" is a promise you have to trust, while "your files are never sent" is an architecture you can verify. For sensitive paper, verifiable beats promised.
How to tell which one you are using
Signals of browser-side processing: the tool works after you disconnect from the internet (load the page, then switch to airplane mode and try); processing is instant even for large images, with no upload progress bar; and the site says so explicitly. Scandut is browser-side by design — detection, correction, enhancement, OCR and PDF assembly all run in your browser, which you can verify with the airplane-mode test.
For the technically curious, the browser’s developer tools settle it definitively: open the Network tab while scanning, and watch whether your image leaves the page. With a browser-side tool you will see the site’s code load once — and no upload of your file, ever.
Sensible rules for sensitive paper
For IDs, contracts and anything with account numbers: prefer a tool that processes locally, or your phone’s built-in scanner. Avoid tools that require an account just to convert one file. And whatever tool you use, check the output before sharing it — the most common privacy leak is not the scanner but sending page two of a PDF you forgot contained your salary.
Beyond the scanner: where scans leak in practice
The scan itself is rarely the weak link. Leaks happen downstream: documents shared to a group chat instead of a person, cloud photo backup quietly syncing your ID card to an album shared with family, old scans sitting in a Downloads folder on a shared computer. Three cheap habits close most of it: keep sensitive scans in one folder you know is not auto-shared, delete scans from chat apps after they are delivered, and mask what the recipient does not need before sending.