People upload bank statements to free converters constantly, and mostly nothing bad happens. But the decision is usually made without looking at what is actually in the file, so it is worth setting that out, and then you can decide for yourself.
What is in a bank statement
In a single PDF, typically:
- Your full legal name and home address
- Your account number and sort code, or IBAN
- Your salary, the exact amount, and the name of your employer
- Your rent or mortgage, and who receives it
- Every direct debit, insurers, utilities, subscriptions, gym, childcare
- Every card transaction: where you shopped, which day, in which town
- Transfers to and from named individuals
That is a month of your movements, your commitments, your income and your relationships, alongside the identifiers needed to impersonate you.
Why it is worth more than your password
A password can be changed in thirty seconds. The information in a statement cannot: you cannot change your salary history, your address history, or where you shopped last March.
It is also precisely the material used to pass identity checks. "Confirm your address and a recent transaction" is a standard verification question at banks, and a statement answers it completely.
Add the account number and sort code, which appear on every page, and you have what is needed to set up direct debits, apply for credit, or open accounts in someone's name.
What uploading actually means
To be fair to the services doing it: most are legitimate, use encrypted transfer, and delete files after processing. The risk is not usually that the operator is malicious.
The risk is everything else. The file sits on a server for some period. It may be logged, cached, or backed up, backups in particular outlive the deletion promise. The company may be breached, may be sold, or may change its policy. Server-side processing usually means the file passes through third-party infrastructure whose retention you cannot see.
None of that is alarming on its own. It is simply a set of risks you take on, in exchange for a service, when the exchange is not necessary.
It is not necessary
That is the part worth emphasising. Converting a statement is text handling and arithmetic, work a browser does perfectly well on its own.
The reason converters upload is not that the task requires a server. It is that server-side is easier to build, easier to charge for, and lets the operator see usage. Those are the vendor's reasons, not yours.
A converter that runs locally does the same job with the file never leaving your device, which is how this one works, and you can confirm it by watching your browser's Network tab, or by going offline after the page loads and converting anyway.
If you do upload one
Sometimes you have no choice, an accountant's portal, a lender's system. Some sensible habits:
Check who you are actually sending it to. Statement requests are a common phishing lure, precisely because the ask seems routine during a loan or rental application.
Prefer the organisation's own portal to email. Email is stored in several places indefinitely, on both sides.
Redact what is not needed. If someone needs to see your income, they rarely need every card transaction.
Be sceptical of "free" with no model. If a service has no advertising, no paid tier and no obvious revenue, it is worth asking what it is getting from the arrangement.