Most free online file converters work exactly as promised, but a meaningful number do not. In March 2025 the FBI’s Denver field office warned that some of these sites hide malware in the file they hand back, or quietly scrape the file you upload for personal data. The safe way to convert a sensitive file is to do it on your own computer, so the file never reaches anyone else’s server.
What the FBI actually warned about
In March 2025 the FBI Denver field office issued a public warning after a rise in reports about malicious file converter websites. The sites look ordinary. They offer to turn a .doc into a .pdf, or merge several images into one document, and most of the time the conversion genuinely works, so nothing feels wrong.
The problem is what comes with it. According to the warning, the file you download can carry hidden malware that gives an attacker access to your computer, and the site can scrape the file you uploaded for personal information. Security researchers at Malwarebytes and BleepingComputer confirmed the campaigns were real and active.
What data these sites can take
The FBI noted that the malicious converters can pull sensitive details out of the files you submit, including:
- Social Security numbers and dates of birth
- Banking and cryptocurrency information
- Email addresses and passwords
That is a serious list, and it makes sense once you remember what people actually convert: tax forms, bank statements, scanned IDs, contracts. Federal investigators suggested this method of attack may have been behind a 2025 ransomware incident at a media company in Davenport, Iowa.
Why “it worked fine” is not proof it was safe
The reason this scam is effective is that the conversion succeeds. You get your PDF, you move on, and the malware or the data theft happens quietly in the background. A converter that returns a working file has told you nothing about whether it also copied your data or slipped something into the download.
How to tell if an online converter is risky
There is no perfect checklist, but these raise the risk:
- It asks you to download and run an app or extension to “finish” a simple conversion.
- It pushes you to disable your antivirus or ignore a security warning.
- The file you get back is an executable (ending in .exe or .scr) when you asked for a document or image.
- It is a site you found through an ad for a very generic term like “free pdf converter”, where lookalike domains are common.
If any of those show up, close the tab.
The safer approach: convert on your own device
The cleanest way to avoid the entire category of risk is to never upload the file in the first place. When a conversion happens on your own computer, there is no server to scrape your data and no download from a stranger to worry about. You can even do it with your wifi turned off and watch it still work.
You have a few local options:
- Built-in tools. On a Mac, Preview and Photos handle common image conversions. On Windows, Photos and Paint cover the basics.
- A desktop converter app. For anything beyond the basics, a converter that runs on your machine handles many formats at once without uploading.
- Self-hosting. Technical users can run their own converter, though it takes setup and upkeep.
Morphjet is built around exactly this idea: it converts more than 1,800 formats entirely on your own computer, with no upload, no account, and no watermark. It launches this July for Mac and Windows. If you would rather not install anything for a single, non-sensitive file, a reputable online tool is fine. The point is to match the tool to the file: the more personal the document, the more it belongs on your own machine.
If you think you already used a malicious converter
Run an up-to-date virus scan, change any passwords for accounts whose details were in the files you uploaded, and watch your bank and email for anything unusual. The FBI asks victims to report incidents to its Internet Crime Complaint Center at ic3.gov.
The bottom line
Online converters are not all dangerous, but you cannot tell the safe ones from the harmful ones by looking, and a successful conversion proves nothing. For anything you would not hand to a stranger, convert it on your own device instead.