Updated: 5 March 2026 · 11 min read
How to Audit PDF Tool Network Requests
You can verify a PDF tool's upload behaviour by tracing request traffic during a real file operation. Runs locally in your browser. No uploads.
This method is built for repeatability: one worksheet, one test file, and a clear pass-fail interpretation that non-specialists can follow.
Audit worksheet
Before testing, create a simple worksheet with these fields:
| Field | Example |
| --- | --- |
| Tool route | /tools/merge-pdf |
| Browser and version | Chrome 134 |
| Test file name and size | audit-sample-2mb.pdf |
| Time window tested | 14:05 to 14:12 CET |
| Result | Pass / Needs review |
This prevents ad-hoc interpretation later.
Step-by-step method
Step 1 - Prepare a clean environment
- open private/incognito session
- disable non-essential extensions
- clear old Network entries
Step 2 - Establish baseline traffic
Load the page and wait for initial static traffic to settle. Mark this as baseline.
Step 3 - Trigger one operation
Select a file and run one complete action from selection to download.
Step 4 - Inspect only operation-window requests
Review requests created during the operation window. Capture:
- request URL
- content type
- request body preview
- payload size
Red-flag criteria
| Signal | Risk level | Interpretation | | --- | --- | --- | | Multipart request created immediately after file pick | High | Likely upload path | | Binary payload matching file size pattern | High | Possible file transfer | | Only static assets and tiny telemetry events | Low | No file transfer evidence in this run | | Processing works fully offline after first load | Low | Strong indicator of local execution |
Decision rule
Use a strict decision rule for consistency:
- Pass: no binary/multipart file payload observed in operation window.
- Needs review: ambiguous payload or unclear route behaviour.
- Fail: clear file-body transfer to remote endpoint.
Document the decision and reviewer name.
Re-test cadence
Re-run this audit when:
- browser major version changes
- tool architecture changes
- your team introduces a new document type workflow
That cadence keeps trust checks practical and current.
FAQ
How long should one audit run take?
A basic audit takes around 10 to 15 minutes once your worksheet is prepared.
Which browser is best for this test?
Any modern browser with a Network panel works. Chrome and Edge are usually easiest for first-time reviewers.
What is a hard fail signal?
A request body containing binary or multipart data that matches the test file operation timing is a hard fail for no-upload claims.
Should I test more than one file size?
Yes. Test both a small and medium file to see whether payload behaviour scales with document size.
Do I need to keep screenshots?
For team governance, screenshots of key requests are useful evidence and reduce future disputes.
Is this security certification guidance?
No. It is an operational verification method.
Related Resources
Audit a live workflow
Use one real task in the tools hub and log your findings with the worksheet below.