How to Merge PDFs Without Uploading Sensitive Documents

Payslips, bank statements, medical letters, ID scans — the documents portals demand as a single attachment are exactly the ones worth handling carefully. This is a workflow for doing it locally.

Why PDFs are the sensitive case

Images are often personal. PDFs are usually identifying. Look at what typically arrives as a PDF and needs combining before it can be submitted anywhere:

• Payslips and employment contracts, with salary and national insurance or social security numbers
• Bank and credit card statements, with account numbers and a complete record of spending
• Medical letters, test results, and insurance claims
• Tenancy and mortgage paperwork, with addresses and financial history
• Passport and ID scans requested for verification
• Client files that you hold under a professional or contractual duty of confidentiality

This is exactly the material that portals demand as a single attachment, which is why "merge PDF" is one of the most-searched file tasks — and why the standard advice to drop the files onto whichever free converter appears first deserves a second look.

There is also a practical dimension beyond personal preference. Many employers and professional bodies restrict uploading client or personal data to third-party services that have not been assessed. If you handle other people's information as part of your job, the relevant question is often not whether a particular site is trustworthy but whether you can account for where the data went. The guide to browser-based conversion covers how to check that for yourself.

What merging actually does

Understanding the operation makes the rest of the decisions obvious.

Merging is structural. A new empty PDF is created, and the pages of each source document are copied into it in sequence, along with the resources those pages depend on — their fonts, their images, their vector artwork. Pages are not re-rendered into pictures and images are not re-compressed, so text should stay selectable, embedded fonts should stay embedded, and images should keep their original resolution.

Two consequences follow. First, page content is copied without intentional rasterisation, downsampling, or lossy recompression, so normal text, vector graphics and embedded images should retain their original visual quality. Second, the output is roughly the size of its inputs added together, because nothing has been reduced. Merging and compressing are separate operations, and the Merge PDF tool page explains the distinction in detail.

A workflow for a sensitive bundle

Merging itself takes ten seconds. The work worth doing is around it.

1. Decide what actually needs to be in the bundle

The most effective privacy step happens before any tool is involved. If a letting agent asks for three months of bank statements, they are asking for proof of income — not for a record of every transaction you made. Sending fewer pages, or a document that shows only what was requested, beats any technical measure. If you need to remove content, do it in software designed for redaction before you merge; a merge tool cannot remove anything.

2. Check each file opens and is the right document

Open every PDF before combining. Scans in particular are easy to get wrong — a page photographed twice, a page missing, a page upside down. The Merge PDF tool can rotate, remove, and reorder pages before export, but it is still easier to spot a problem in the source than in a 40-page bundle.

3. Merge locally

Open the Workbench Merge PDF tool, add your files in order, and click Merge. The files are read into your browser tab and combined there; they are not uploaded to a Workbench server. If you want to confirm that rather than take it on faith, load the page, disconnect from the internet, and run the merge — it will still work.

4. Check the output before you send it

Open the merged file and page through it. You are looking for three things: that every page is present, that the order is right, and that nothing has come along that you did not intend to include. This last one matters more than people expect — see below.

Getting the order right first time

In the Workbench tool you set the order in two steps: first the files, with the move buttons beside each one, and a page range for any file you only need part of; then individual pages, by dragging page cards or using their move buttons. Each page card shows its source file and its original page number, and the page number it will have in the export. Adding another file later appends its pages without undoing your edits; if changing the file order or a range would undo edits, the tool asks before doing it.

Two habits still help. Glance at the page list before exporting — it is exactly what the output will be. And if you are selecting many files at once, sort the folder by name or date first: most file pickers hand files over in the order they are displayed, so a naming scheme like 01-cover.pdf, 02-contract.pdf, 03-annex.pdf does the sorting for you.

When a file is password-protected

Encrypted PDFs cannot be merged and will report an error. This catches people out regularly, because the documents most likely to be encrypted are exactly the ones most likely to need bundling: bank statements, payslips, and pension documents are often protected with a date of birth or a customer reference, sometimes without any obvious prompt when you open them in a viewer that remembers the password.

The tool does not attempt to work around document protection, and that is deliberate. If the document is yours and you have the password, open it in software that can save an unprotected copy, and merge that copy instead. Then delete the unprotected copy once you have what you need — an unencrypted bank statement sitting in your downloads folder is a small risk you created and can easily remove.

Merging is not redaction — and this is the part people get wrong

Because merging copies pages rather than re-rendering them, page-level content and resources come across, including anything drawn outside the visible page area, along with annotations attached to those pages. Document-level structures — metadata such as author and title, outlines, attachments, form structures, and signatures — may or may not survive the copy, and you should not rely on either outcome.

What this means in practice is simple: do not treat a merge as a cleaning step. Three specific traps are worth naming.

• Content hidden by a drawn rectangle is not removed. Covering a number with a black box in a general-purpose editor often leaves the original text underneath, selectable and copyable. Genuine redaction removes the content; drawing over it does not. This has produced real disclosure incidents in legal and government documents.
• Annotations and comments travel with the page. Review notes on a draft contract are attached to pages, so they can come across intact into the merged file.
• Do not assume metadata is stripped. Author names and titles may be carried or dropped depending on the structure involved. If a document's properties must not be visible, check the output rather than assuming.

The rule that follows: clean the source documents, then merge, then verify the result. Never rely on the merge to do the cleaning.

When a browser tool is the wrong choice

Being clear about this is more useful than pretending one tool fits everything.

• Very large scanned documents. Every source file plus the output is held in your device's memory at once, so peak usage exceeds the combined file size. Hundreds of megabytes of scans will strain a phone and may strain a laptop. Merging in stages — combining a few files, then merging the results — keeps peak memory lower.
• You need real redaction. Use software built for it, which removes the underlying content rather than covering it.
• You need to keep forms, signatures, bookmarks, or accessibility tags working. These document-level features are not carried into the export. Use the software that created the document.
• The document must stay signed. Any modification to a signed PDF invalidates the signature — that is how signatures work, not a limitation of this tool. Merge first, then sign the combined document.
• Your organisation mandates a specific tool. If there is an approved internal process, use it. "It ran locally" is a good answer to an auditor, but a documented approved workflow is a better one.

Building a bundle from paper

If part of what you are combining exists only on paper, photograph or scan the pages, turn them into a PDF with Image to PDF, and merge that with your existing documents. Turning scanned or photographed pages into one PDF covers the capture side, including the resolution to aim for and why the result will not be searchable.

Related