How to convert files without getting malware
The FBI warned that free online file converters are being used to plant malware and harvest personal data. The warning is real. The checks take about thirty seconds.
What the warning said
Criminals use free online document converter tools to load malware onto victims' computers, leading to incidents such as ransomware.
FBI Denver Field Office, March 2025
These sites convert your file correctly. That is exactly why it works: nothing looks wrong. The download can carry a payload, and the site can quietly scrape your upload for names, dates of birth and Social Security numbers.
Malwarebytes traced the payloads on 17 March 2025, mostly information stealers after saved passwords and session tokens. A stolen session token walks straight past two-factor authentication, because it reuses a login you already completed. One campaign bought search ads for converter keywords, so the malicious result can sit above the real one. Their write-up lists the domains flagged at the time.
Check before you upload
Earlier checks catch more than later ones.
- Read the domain letter by letter.Typosquats change one character or the ending. Type it yourself; the top search result can be an ad.
- Never install anything.A web converter hands back a file. An app, an extension or a "download manager" means the conversion was bait.
- Check what came back.The wrong extension, or a double one like report.pdf.exe, is an attack rather than a glitch.
- Assume the upload gets read.Passports, payslips and contracts do not belong in a stranger's tool.
- Look for a retention policy and a price.A service that says how long it keeps files, and how it makes money, has answers. Silence usually means you are the product.
- Convert offline when it really matters.Desktop tools like pandoc and ImageMagick run locally, cost nothing, and never put the document on a network.
Walk away if
- The download is an installer, or an archive with one inside.
- It wants a browser extension or notification permission first.
- It tells you to switch off your antivirus.
- There is no privacy policy, no terms, and no way to reach anyone.
If you already used one
- Change your passwords from a different, clean device.
- Revoke active sessions everywhere; stolen tokens outlive a password change.
- Call your bank if card or account details were in the file.
- Run a full anti-malware scan, and rebuild the machine if a stealer is confirmed.
Report it at ic3.gov either way. Those reports are how the domain lists everyone else relies on get built.
How FileChanger is different
All three are visible from outside, so check them rather than taking our word for it.
The response is the file
Conversion runs on our servers and the reply is the converted bytes. No app, no extension, nothing we could hand you to run.
Files are deleted, not archived
Your upload goes the moment the conversion ends. The result goes when you download it. Anything left expires within the hour.
We charge money
One domain, filechanger.io, over HTTPS, with the paid tiers on the pricing page. That is the boring answer to "how is this free?".
Convert the file, skip the installer
Upload in the browser and download the result, or make one API call from your own code.
Frequently asked questions
Are free online file converters safe?
Some are. The dangerous ones convert your file correctly, so the output tells you nothing. Judge the site instead: its domain, whether it asks you to install anything, and whether it says how long it keeps your file.
Can a converted file contain malware?
Yes. It can be an executable dressed up as a document, or a document carrying a script. A double extension like invoice.pdf.exe is the clearest tell.
Does FileChanger keep my files?
Not for long. Your upload is deleted when the conversion finishes, the result when you download it, and anything left over expires within the hour. The privacy policy covers the rest.