Why browser-based actually matters
Most people assume HTTPS upload means safe. It does for transmission, but the file still exists on a server afterward. iLovePDF terms say uploaded files are deleted after two hours; their privacy policy allows longer retention for security reasons. Neither is unreasonable. It does mean your file briefly lives on a server you do not control, can be subpoenaed, could leak in a breach, or be scanned by the provider. On many corporate networks, IT policies forbid uploading documents to third-party processors at all.
PDFMerger.io does not upload anything. Open DevTools, switch to the Network tab, and merge files. You will see zero PDF bytes leave your computer. The merging happens in JavaScript and WebAssembly inside the page.