Is it safe to upload a contract to a free PDF site?

What happens to a file you upload

We checked three free PDF-signing sites: Smallpdf, iLovePDF and Sejda. Each works like this: you upload the PDF, draw, type or upload your signature, place it on the page and download the result. Behind that, three things happen to your contract on those sites.

1. It travels to the site's servers, encrypted on the way (HTTPS), and decrypted when it arrives.
2. It is processed there. A file a server edits has to be readable on that server while it works on it, so the site has your contract in readable form, at least for that moment.
3. It is kept for a while. How long, and in what form, is whatever the site's own policy says.

Here is what those three sites say about the files they handle, as published on their own pages on October 12, 2026:

• Smallpdf: "Your PDFs are TLS-encrypted, and all files are automatically deleted after one hour unless you save them to your Smallpdf account."
• iLovePDF: "all files processed within our platform are automatically and permanently deleted within two hours of being processed", and "we retain signed documents for a maximum of 5 years in compliance with legal requirements." It also says it uses "end-to-end encryption to ensure the highest level of security for your data from the moment you upload it until it's processed and delivered back to you".
• Sejda: "Documents are encrypted in transit and at rest", and "Our employees do not access your documents without your consent."

These are sound practices. They protect your file from outsiders on the way and on the site's disks. They don't keep it from the service that processes it, and they depend on the site's own systems and staff for as long as the file is there. Other free sites may work differently: ask the questions below of any site before you upload.

What the signature proves

On these sites, as with the markup tools on your own phone or computer, you draw, type or upload your signature and place it on the page. The result is a picture of a signature. A picture can be copied onto any other document, and on its own it doesn't tie the signature to you or to this version of the contract. Sejda's signing tool notes: "Sejda does not guarantee that the signature provided through this tool is legally binding."

A typed or drawn signature can still be a valid electronic signature: is a typed name a legal signature? explains when. The weak point is proof. If the other party later says the contract was changed, or that they never agreed to it, an image on its own shows little about who signed, exactly what they signed, or when. How to prove someone signed electronically covers what that proof needs.

Four questions to ask before you upload a contract

1. Who can read it once it leaves my device? If the site processes it on its servers, the site can. Look for encryption that happens in your browser, before upload.
2. How long is it kept, and why? Find the deletion time in the privacy policy, and check whether saving to an account, or using a signing request instead of a quick tool, changes it.
3. What rights do the terms give the site over my upload? Read the content license in the terms of service. OpenSign's terms, for example, say you "retain all rights in" what you upload, and that uploading grants its operator "a worldwide, non-exclusive, royalty-free license to use, reproduce, display, perform, adapt, modify, publish, and distribute such content in connection with the Services" (as published on October 12, 2026).
4. What will I be able to prove later? If the answer is a downloaded PDF with a signature image, you will have little to show if the contract is questioned. A contract deserves a record of who signed, what they signed, and when, that someone else can check.

When a free tool is fine, and when it isn't

A free PDF site, or the markup tool already on your device, is a reasonable choice for paperwork with low stakes: a form you sign for your own records, a delivery note, an event sign-up with nothing sensitive in it. If all you need is your signature on the page, you don't have to upload anything: Preview on a Mac can "capture your signature using your trackpad, the built-in camera on your Mac, or your iPhone or iPad", and Markup on an iPhone adds a signature you draw with your finger.

Use something stronger when the document:

• carries prices, salaries, account numbers or personal details;
• binds you to pay, deliver or keep something confidential;
• may need to be proven later, to a client, a landlord, a lender or a court;
• needs another person's signature too.

For agreements whose terms must stay between the parties, see how to sign a confidential agreement privately.

Sign a contract for free, without handing over a readable copy

Attest is built for exactly those documents, and you can start for free.

• Your contract stays unreadable to Attest. Your browser encrypts the PDF before upload, and Attest stores your document only as ciphertext it can't read. Only you, and anyone you send it to, can open it, in your own browsers.
• The signature is yours, not a picture. You adopt a signature by typing your name in a handwriting style or drawing it, and you sign with your passkey: a cryptographic key only you control, unlocked with Face ID, Touch ID, Windows Hello or the device PIN. The passkey signs a statement that names the exact document, by its fingerprint, and everything you entered on it. The drawing is how the signature looks; the passkey is what makes it binding.
• The signed copy proves itself. You download a sealed PDF: the signed pages, with a "Signed with Attest" stamp on each signature and a seal line at the foot of every page, a certificate of completion, the audit trail up to completion and a "Verify it yourself, without us" page, with the full evidence, the original document and a standalone verifier attached inside. Anyone can check it for free at attest.datahubz.com/verify, and the open-source verifier inside the PDF runs in any browser, even without Attest, and checks each signer's passkey signature, the original document, the pages you see and Attest's anchored record on Horizen, a public blockchain.

	The free PDF-signing sites we checked (as Smallpdf, iLovePDF and Sejda describe it, October 12, 2026)	Attest
Where your contract is readable	On the site's servers while it is processed	Only in the browsers of you and the people you send it to
How long the site keeps it	Deleted after one hour (Smallpdf) or within two hours of processing (iLovePDF); signed documents up to 5 years at iLovePDF	Kept as ciphertext Attest can't read, so the parties can download the signed copy later
What the signature is	An image placed on the page	Your passkey's signature over the document's fingerprint and your entries
How someone checks it later	By looking at the page	Free, with no account, at attest.datahubz.com/verify or with the verifier inside the PDF
Cost	Free, with each site's own limits	2 documents free, in total; then $5 a month for 20

To sign a PDF someone emailed you, sign in at attest.datahubz.com, set up your signing key once, open Documents (or Agreements) and click Sign a document yourself: upload the PDF, place your signature, sign with your passkey and download the signed copy to send back. It uses one of your documents. On the Free plan its record is anchored within about 10 minutes, and on the Signing plan the moment it is complete. How to sign a PDF on your iPhone walks through every tap.

If the other party sends you their document through Attest, signing it is free on any plan and uses none of your documents: you need no account, no password and no payment.