Secure HEIC to PDF: Converting Sensitive Documents Without Uploading Them

September 12, 2026 · 11 min read

Most of the time, turning an iPhone photo into a PDF is a chore, not a risk. You photographed a whiteboard, you need it as a PDF, any tool will do.

But a large share of HEIC-to-PDF conversions are not whiteboards. They are photos of a passport for a visa application, a driver's licence for a rental, a payslip for a mortgage broker, a signed contract, an insurance claim, a medical letter, a tax form, a utility bill for proof of address. The reason it has to be a PDF at all is usually that some portal, lawyer or HR system demanded a PDF — which means the document is official by definition.

For those files, the normal advice ("just use an online converter") quietly asks you to do something you would never do deliberately: send a photograph of your identity documents to a company you have never heard of, hosted somewhere you didn't check, to be written to a disk you don't control.

There is a way to get the PDF without that step.

The short answer

Open HeicQuick in your browser, add your HEIC files, choose PDF as the output format, and press Convert. The conversion runs entirely on your own device — the photo is read from your disk by code running in your browser tab, turned into a PDF there, and saved straight back to your disk. Nothing is uploaded, so there is no server copy of your passport or payslip to worry about. It is free, needs no email address, no account and no sign-up, adds no watermark, and once the page has loaded you can disconnect from the internet entirely and it will still work.

The rest of this post is what "runs locally" actually means, how to check that claim on any converter, and how to get a multi-page PDF out of a stack of photos.

Why the upload step is the entire risk

When a converter runs on a server, the architecture forces a specific sequence:

1. Your file is read off your disk and sent over the network.
2. It is written to that company's storage.
3. Their code opens it, converts it, and writes a second file — the PDF.
4. A download link is created, usually a public, unguessable URL.
5. At some later point, both files are deleted. Probably.

Every honest server-side converter has a retention policy, and most of them are genuine — "files deleted after one hour" is a real commitment that real companies keep. But notice what a retention policy is: a promise about how long your document stays on their disk. It is not a statement that the document was never there.

For a whiteboard photo, that's fine. For a scan of your passport, the difference between "deleted after an hour" and "never transmitted" is the entire question. In the hour it existed, the file sat in storage, passed through logs and backups, traversed a CDN, and lived behind a download URL that was emailed, cached or left open in a browser tab. Data breaches don't happen at the moment of upload; they happen months later, to the storage bucket nobody remembered was still there.

There's also a boring, non-paranoid version of the same problem: many workplaces simply forbid it. If you handle client files, patient records, legal documents or anything under an NDA, uploading them to a third-party web service is a policy violation whether or not anything bad ever happens.

What "convert HEIC to PDF locally in browser" actually means

The phrase gets used loosely, so here is the precise version.

A modern browser can decode HEIC and write PDFs without any server help. The page you load contains the conversion code — a WebAssembly HEIC decoder and a PDF writer — and that code executes inside your browser tab, on your own CPU. When you drop a file onto the page, the browser hands the page a reference to bytes already on your machine. The conversion reads those bytes, produces a PDF in memory, and offers it to you as a download that your browser writes back to your own disk.

At no point is there a network request carrying your photo. Not a small one, not an encrypted one, not a "temporary" one. The file is never serialized into an HTTP request at all, because nothing in the design ever needs it to be.

This is how HeicQuick works, and it is why there is no file-retention policy on the site to read. There is nothing to retain. The only thing that crosses the network is the page itself, in the same direction as any other web page: code down, never files up.

To be completely precise about that: loading the page does fetch a PDF-writing library and a ZIP library from a public CDN, in the same way the page fetches its own HTML. Those are downloads of code to your machine. Your photograph travels in no direction.

How to verify the claim yourself, on any converter

You don't have to take anyone's word for this, including ours. Three checks, in increasing order of effort:

1. Pull the plug. Load the converter page, then turn off Wi-Fi or unplug the ethernet cable. Now try to convert a file. A local converter will complete the job offline — the code is already on your machine. A server-side converter will fail immediately, because it has nowhere to send the file. This is the single most conclusive test there is, it takes ten seconds, and it cannot be faked.

2. Watch the network tab. Press F12, open the Network panel, and convert a file. You are looking for an outbound request whose payload is roughly the size of your photo — a couple of megabytes going up. On a local converter, the biggest thing you'll see is the initial page and engine download coming down, and nothing at all during the conversion.

3. Read the source. If the tool is open source, the conversion code is public and you can check exactly what it does. HeicQuick's is at github.com/xieliaing/heic-web — there is no backend in the repository because there is no backend.

Apply those tests to any converter you're considering for a sensitive document. A site that fails the airplane-mode test is a server-side converter, whatever its homepage says about privacy.

Free, with no email and no registration — and why that's possible here

Search for a HEIC to PDF converter and you'll meet the standard funnel: convert one file free, then hit a wall asking for an email address "to send your download link," a sign-up for a free account, a two-file-per-day cap, or a watermark stamped across the output unless you upgrade.

None of that is arbitrary greed. It is the direct consequence of server-side conversion: your file costs them bandwidth to receive, disk to hold, and CPU to convert. Someone has to pay for that, so free users get capped, monetised, or converted into a mailing list.

A browser-side converter has none of those costs, because the machine doing the work is already yours and you're already paying its electricity bill. So there is nothing to recoup:

• No email address. There's no download link to email you — the file is saved directly by your browser.
• No account or registration. There is no per-user state to store, because there are no user files on any server.
• No watermark. The output is your photo, at the quality you chose. We couldn't stamp it even if we wanted to; we never see it.
• No daily limit, no queue. You're not sharing a conversion server with anyone, so there's nothing to ration.

Ironically, the privacy story and the free story are the same story. Not having your file is what makes it cheap to give away.

Converting a stack of photos into one PDF

The common real-world job is not one photo. It's "here are four photos of a three-page contract and its signature page, and the portal wants a single PDF." That's supported directly:

1. Open HeicQuick and drag in all the HEIC files at once.
2. Choose PDF as the output format.
3. Under PDF Mode, pick Combine all into one PDF.
4. Drag the rows into the right page order — the list order is the page order.
5. Set the quality slider. 92 is the default and is right for documents; drop it toward 70 if a portal has a strict file-size cap.
6. Press Convert, then download the single PDF.

Choose One PDF per image instead when each photo is a separate document — three different receipts, say. With more than one file, those come down together as a ZIP.

A few details that matter for official uploads:

• Each page is sized to its photo, not forced onto A4. There are no white margins and no letterboxing, and a landscape photo produces a landscape page, so nothing is cropped or shrunk to fit a paper size it was never shaped like.
• The image inside the PDF is JPEG, at the quality you chose. That keeps the file small enough for portals that cap uploads at 5 or 10 MB, while staying legible — a passport photographed on a modern iPhone stays comfortably readable at the default.
• No metadata is added. Nothing stamps your name, an account ID, or the converter's branding into the document.

Sensitive documents: a short practical checklist

If what you're converting is an identity document or a financial record, these habits cost nothing:

• Convert on the device that already has the photo. Emailing the HEIC to yourself to convert it on a laptop puts a copy in two mailboxes and on a mail server. If the photo is on your iPhone, open the converter in Safari on the iPhone.
• Do the airplane-mode test once, on whatever tool you settle on. Ten seconds, permanently answered.
• Check the PDF before sending it. Open it and confirm the whole document is in frame, in focus, and the right way up.
• Delete the intermediate copies afterwards — the original photo in your camera roll and the PDF in Downloads, once the portal has accepted it.
• Prefer the portal to email. If the recipient offers a secure upload form, use it rather than attaching the PDF to an email, which is the least private hop in the whole chain.
• Beware "free scanner" apps. Many phone scanner apps that produce PDFs do it by uploading to their own cloud for "enhancement," which puts you back where you started, with an account attached.

Common questions

Is it safe to convert HEIC to PDF online? It depends entirely on whether "online" means a website you loaded or a server you sent your file to. A browser-based converter that runs the conversion locally is as safe as opening the photo in your own photo viewer, because that's structurally what happens. A converter that uploads the file is exactly as safe as the company operating it, which you have no way to audit. The airplane-mode test tells you which kind you're using.

Does the site ever see my document? No. There is no server-side conversion in HeicQuick at all, so there is no upload step, no temporary storage and no deletion window — the file never arrives anywhere to be stored or deleted.

Do I need to install anything? No. No app, no extension, no desktop software, and nothing to install on a locked-down work machine where you couldn't install software anyway.

Does it work offline? Yes, once the page has loaded. That's the same property that makes the airplane-mode test work.

Will there be a watermark? No. Free, unlimited, and unmarked.

Can I combine multiple HEIC photos into one multi-page PDF? Yes — choose PDF, then "Combine all into one PDF", and drag the rows into the page order you want.

Is the text in my document searchable in the PDF? No. This is a photo wrapped in a PDF, not OCR — the page is an image, so text in it isn't selectable or searchable. For an upload portal that wants a scan of a signed form, that's exactly what's expected. If you specifically need searchable text, you need an OCR tool, and the honest ones for sensitive documents are desktop applications.

What about PDF file size? Lower the quality slider. Going from 92 to about 75 typically cuts the file size substantially with no visible difference on a document photographed in decent light.

The bottom line

The reason your bank, letting agent or immigration portal wants a PDF is that PDFs are how official documents move. Which means that a large fraction of HEIC-to-PDF conversions involve exactly the documents you'd least like to hand to a stranger — and the conventional online converter asks you to hand them over as step one.

You don't have to. Your browser can do the whole job on your own machine: decode the HEIC, write the PDF, save it to your disk, with no upload, no account, no email address and no watermark.

Convert it locally: HEIC to PDF in your browser. If you need a plain image instead, the same page does HEIC to JPG and HEIC to PNG, and the format itself is explained in what is a HEIC file. If a website is rejecting your iPhone photo outright, that's a different problem with a straightforward fix.