What a PDF actually contains
A PDF is not a picture of a document — it is a container of objects. Each page holds a content stream: a sequence of operators saying "set this font, move to this coordinate, draw these glyphs". Fonts, images and metadata are separate objects, and a cross-reference table at the end of the file records the byte offset of every one of them, which is what lets a reader open page 400 of a large document instantly without parsing the first 399.
The unit of measurement throughout is the point, defined as exactly 1/72 of an inch. A4 is 595 × 842 points and US Letter is 612 × 792, which is why a document designed for one prints with the wrong margins on the other — they differ in both dimensions, not just length.
Each page also carries several rectangles. The MediaBox is the physical sheet, and the CropBox is the region a reader actually displays. Because cropping a PDF usually just changes the CropBox, the content outside it is still in the file — hidden in the viewer, and recoverable by anyone who resets the box. That distinction matters whenever you crop something sensitive out of a page.
Edits append rather than overwrite
PDF supports incremental updates: when a reader saves a change, it can append the new objects and a fresh cross-reference table to the end of the file rather than rewriting it. The old objects stay exactly where they were. This is what makes digital signatures verifiable — the signed bytes are untouched — and it is also why PDFs grow with each save.
The privacy consequence is significant and widely overlooked. Text that was deleted, an image that was replaced, or a page that was removed may still be present in an earlier revision inside the same file. There have been repeated incidents of redacted legal and government documents where the removed text was recoverable with a text extractor, because a black rectangle was drawn over the text rather than the text being deleted.
Genuine redaction requires removing the underlying content and then rewriting the file without the previous revisions. If you need to be certain something is gone, converting the page to an image and rebuilding the PDF from that is crude but reliable, since it discards every object the old page contained.
Why everything here runs in your browser
Documents in PDF form are disproportionately the sensitive ones — contracts, medical letters, bank statements, signed agreements. Uploading them to a web service means handing the file to someone else's server, where it exists at least in memory and often on disk, subject to that operator's retention policy and jurisdiction.
These tools use the browser's own file APIs, so the document is read into memory on your machine, manipulated there, and written back out as a download. Nothing is transmitted, which you can verify by opening your browser's network panel and watching that no upload request occurs, or simply by disconnecting from the network before using the tool.
The practical limit of that approach is memory rather than privacy: a very large scanned document has to fit in a browser tab alongside its output. For everyday files this is not a constraint. Related: merge, split and compress.