When you need to merge a PDF or convert a photo, do you just upload it to whatever online converter shows up in search results? In 2024, a real mass leak happened on exactly this kind of site.
According to a July 2024 report from security research team Cybernews, two UK-based online PDF conversion sites (PDF Pro and Help PDF — run by the same company) left the cloud storage holding user-uploaded files publicly accessible with no password. That storage held over 89,000 user files, including passports, driver's licenses, ID cards, various certificates, and even signed contracts. The researchers warned this kind of data could be abused to open bank accounts or get credit cards issued in someone else's name, and as of the report, the company hadn't responded to the disclosure.
The real problem is that even when a site says "we delete your file right after converting it," once a file reaches a server, the user has no way to verify that claim. This incident proved that a single storage misconfiguration can expose tens of thousands of people's files all at once.
CornButter never sends your file to a server in the first place. Merging and compressing PDFs, converting photos — all of it runs entirely in your browser, and the result only ever exists on your own device. Open your browser's developer tools and check the Network tab yourself — you'll see nothing gets uploaded anywhere.
Try it right now on CornButter — whether it's a passport scan or a contract, your file never leaves your device.