Why are we still uploading confidential PDFs to cloud servers just to merge pages?

In 2026, developers building web tools often follow the standard microservice architecture. When users upload sensitive documents—bank records, tax PDFs, contracts—over the wire, a backend server spins up CPU threads to merge the pages. This process stores temporary files, consumes egress bandwidth, and risks exposing personally identifiable information if the server is compromised.

Recently, the author of UtilifyAI's PDF suite transitioned away from this traditional approach to a 100% client-side solution. By utilizing pdf-lib, browser WebAssembly, and Blob APIs, all the heavy lifting—such as merging PDF pages—now occurs directly on the client's computer. The result is zero compute and storage overhead, as the client handles ArrayBuffers directly.

Additionally, this zero-server approach ensures instant GDPR and HIPAA compliance, as files never leave the user's device. Offline resilience is also improved, as the tool works seamlessly with spotty internet connections once the files are cached.

The author has detailed the complete code breakdown of this client-side PDF merging process on Dev.to in an article: "How to Merge PDF Files in the Browser Without Server Uploads." The piece raises an important question for developers: where should the line be drawn between client-side processing (considering memory pressure on low-end devices) and server-side offloading? Have you transitioned other traditionally backend operations—like image compression, EXIF scrubbing, or OCR—entirely to the browser as well?