Merging PDFs is a small task with an outsized privacy footprint, because of which PDFs people tend to merge. Look at what actually goes through these tools: contracts, invoices, tax returns, medical letters, scanned passports, signed agreements, mortgage paperwork.
Those are close to the worst possible category of document to upload to a server you know nothing about — and they are the ones most often pasted into whichever free tool a search returns first.
The options, ranked by what they cost you
A desktop application. Preview on macOS merges PDFs by dragging pages between thumbnails. On Windows, most PDF readers do it. Nothing leaves your machine. The cost is that it is fiddly for more than a few files and there is no batch mode.
The command line. qpdf --empty --pages a.pdf b.pdf -- out.pdf is exact, scriptable, and
completely local. The cost is knowing that this exists and having it installed.
A browser-based tool that processes locally. Modern browsers can read, manipulate and write PDFs without a server. That is how ours works — the merge runs in the page, your file never goes anywhere, and you can confirm that in your browser’s network tab.
A server-based tool. This is what most search results are. Your document is uploaded, merged remotely, and returned. It works, and for a menu or a flyer the exposure genuinely does not matter. For a signed contract, it is worth a second thought.
How to tell which kind you are using
Open your browser’s developer tools before you start, switch to the Network tab, and merge something. If a large upload appears, your file was sent. If nothing moves, it was not.
That five-second check is more informative than any privacy policy, because it observes what the software does rather than what its operator says about it.
What merging does and does not preserve
Worth knowing regardless of which tool you use.
Preserved: page content, embedded fonts, images and vector graphics. A proper merge copies pages structurally rather than re-rendering them, so there is no quality loss and no re-compression. The pages in the output are the same pages, not pictures of them.
Not preserved: interactive form fields, annotations, bookmarks, and digital signatures. Form data is the one that catches people out — if your source PDFs contain filled-in forms, flatten them in your reader first or the values disappear. Digital signatures are invalidated by any modification at all, which is inherent to how signing works rather than a flaw in any particular tool.
Blocked: password-protected files. Encryption has to be removed first, in a reader, with the password. Any tool claiming to merge an encrypted PDF without one is either failing silently or doing something you should not want.
Going the other way
The related problem — needing to send part of a document — has the same shape and a sharper irony. Uploading a complete bank statement to a server in order to extract the two pages you meant to share defeats the entire purpose. Splitting locally avoids that.
The rule of thumb
If you would not email the document to a stranger, do not upload it to an unfamiliar web tool. For everything else, the convenience is real and the risk is small. The point is to make that call deliberately rather than by default.