Is it safe to upload a PST file to an online converter?

A PST is often years of someone's mail, attachments and contacts in one file. Before you send it to a website to convert, here is what actually leaves your computer, what the file's own protection is worth, and the questions to ask first.

Published Facts checked 9 min read
Two routes for converting a PST. Upload route: the file travels over the internet to the converter's server, where a copy is kept until it is deleted, and the result comes back. Local route: the file is read and converted inside the browser on your own computer, and only the web page itself is downloaded.
Uploading copies the whole mailbox to someone else's server. A tool that runs in the browser reads it where it is.

Short answer: it can be done safely, but only if you trust the service with everything in the mailbox, because uploading hands a complete copy of it to someone else’s server. A PST’s password does not protect the contents, and you usually cannot check how long the copy is kept or who can reach it. For a mailbox with anything private in it, a tool that converts the file on your own computer is the safer choice, and there are free ones that run in the browser without an upload.

The rest of this article explains why, and what to check if you decide to upload anyway.

What is inside a PST file

A PST (Outlook Data File) is Outlook’s local store for mail. Depending on how it was made, one file can hold:

  • every email in the folders it covers, often going back many years, with full headers that show addresses, servers and dates;
  • every attachment: contracts, scanned IDs, payslips, invoices, medical letters, spreadsheets;
  • contacts, calendar entries and tasks;
  • other people’s personal details, because every message has a sender and recipients who never agreed to their mail being shared.

That last point is easy to miss. A mailbox is rarely only yours. Sending it to a third party also sends the correspondence of everyone you have exchanged mail with.

What actually happens when you upload one

An online converter that works on its servers needs the whole file. The steps are the same everywhere:

  1. Your browser sends the PST over the internet to the converter’s server. HTTPS protects it on the way, but not after it arrives.
  2. The server stores the file, reads it and writes the converted result.
  3. You download the result, and the service later deletes the files according to its own policy.

Each step is a point you cannot see. You do not know where the servers are, which subcontractors host them, whether files are copied into backups or logs, or who on the provider’s side can open them.

Retention promises vary, and they are the provider’s own statements, not something you can verify. As examples, checked on 4 November 2026: Stellar’s online OST converter says converted files are permanently deleted within 24 hours on its free plan and 48 hours on its premium plan, and does not say when the uploaded original is deleted. Aspose’s OST to PST page says the download link is valid for 24 hours, while an Aspose blog post states that uploaded and converted files are deleted automatically after 24 hours. Neither is a bad policy on paper. The point is that a policy is a promise, and you are trusting it with the whole mailbox.

Why the PST password does not help

Outlook lets you put a password on a PST, and many people assume that makes the file safe to hand over. It does not.

Microsoft’s own file format specification is direct about it. The PST password section of MS-PST says the password is “a superficial mechanism” that Outlook enforces, that it is not used as a key to the encoding, and that it “does not provide any security benefit to preventing the PST data to be read by unauthorized parties.” It is stored as a CRC-32 checksum, which the same page calls “relatively weak against a brute-force approach.”

The encoding options Outlook offered when you created the file, often labelled “compressible encryption” or “high encryption”, are not encryption either. The specification’s section on the strength of encoded data blocks says these use two keyless algorithms that “only provide data obfuscation”, and that the header and index pages are stored without even that.

How a PST is protected: the password is a CRC-32 value checked only by Outlook; message data is obfuscated with a keyless, published algorithm; the file header, page maps and B-tree pages are not encoded at all. None of the three stops a program that reads the format.
What each of a PST's protections actually does, according to Microsoft's MS-PST specification.

So any program that reads the PST format can read a password-protected PST. A converter you upload to can read yours, by design.

The risks are not hypothetical

Two documented cases show the two main ways uploads go wrong.

Files left open. In July 2024, the Cybernews research team reported that two online PDF converters, PDF Pro and Help PDF, had left their Amazon S3 storage open to anyone, exposing 89,062 uploaded files including passports, IDs, certificates and contracts. BGR’s report noted the data was still exposed at the time and the providers had not replied. These were PDF tools, not mail converters, but the failure is the same one any upload service can have: a storage setting, not a hacker, made the files public.

Converters built to steal. In March 2025, the FBI’s Denver field office warned that criminals run free online document converters that perform the conversion but return files carrying malware, and that can harvest personal information, banking details, email addresses and passwords from the files people submit. A mailbox is an ideal target for that kind of harvesting, because it is full of exactly those things, and password reset emails besides.

We found no public report of a breach at a PST converter specifically. That is not evidence that none has happened, only that none has been disclosed.

If you are handling mail for an organisation

For a business mailbox, the question is not only technical. Sending other people’s personal data to an outside service usually makes that service a processor of the data. Under the GDPR (in force in the EU, with an equivalent in the UK), Article 28 expects a written agreement with any processor that sets out what it may do with the data. A free website you found through a search is unlikely to offer one.

Many organisations also have policies that forbid uploading company data to unapproved services, and mailboxes kept for records or legal reasons can need a documented chain of custody. Check with whoever owns data protection before you upload anything. This article is general information, not legal advice.

Questions to ask before you upload

If you still want to use an upload service, for example for a small mailbox with nothing sensitive in it, check these first:

QuestionWhere to lookA good answer
Who runs the service, and where?Imprint, terms, privacy policyA named company with an address, and a stated country for its servers
How long are uploaded files kept?Privacy policy, FAQA specific time for both the original and the result, including backups
Can people at the company open files?Privacy policy, security pageA clear statement of who can, and when
Is the file used for anything else?Privacy policy, termsNever used for training, analytics or shared with third parties
What do you get back?The download itselfThe format you asked for. An .exe, .bat or .scr file is a warning sign; do not run it
Can you delete it yourself?The serviceA delete button, or a written process with confirmation

Then reduce what you send. Export only the folders you need into a new PST, rather than uploading a whole archive, and remove anything sensitive you do not need converted.

Converting without uploading

A conversion does not need a server. The PST format is published by Microsoft, so a program on your own computer can read it, and today that program can run inside a browser tab.

That is how Mailtria works. Its PST engine is compiled to WebAssembly and runs in your browser, so the PST Viewer opens a PST in place, and the converters such as PST to MBOX or PST to EML write the result on your computer. There is no upload step. The security page lists exactly what the server does receive: if you have an account, a note that a run started and finished, with no file names or contents.

You do not have to take that on trust. In Chrome or Edge, press F12, open the Network tab, then choose your file and run a preview. The list shows the site’s own files and, if you are signed in, the two small run notes, but never your PST or anything from it. Google explains how to read that panel in its Network panel guide. The same check works for any tool that claims to run locally.

Other offline routes exist too. Outlook itself can import and export PST files if you have it, and desktop converters work without an upload. The PST, OST, MBOX, EML and MSG guide explains which format to convert to for each mail app.

Local is safer, not invulnerable

Keeping the file on your computer removes the third party, but it does not make the file safe by itself:

  • Malware on your own computer can read anything you can. Keep the system updated and use security software.
  • Browser extensions with permission to read every site can see what a page shows, including a mailbox open in a viewer. Use a browser profile without extensions for sensitive files.
  • Copies spread. Converted MBOX or EML files are as sensitive as the PST. Delete the ones you no longer need, and remember downloads folders and USB drives.
  • Disks get lost. Turn on full-disk encryption: BitLocker on Windows or FileVault on a Mac. Unlike the PST password, this actually encrypts the file at rest.
  • Keep the original. Work on a copy, and keep the untouched PST until you have checked that the converted mail is complete.

The bottom line

Uploading a PST is a decision to trust a stranger with a full mailbox, including other people’s mail, on the strength of a privacy policy. For a test file or mail with nothing in it that matters, that can be fine. For anything else, use a tool that does the work on your own computer, check in the Network tab that it really does, and protect the file where it lives.

Sources and further reading

PST ViewerOpen and read the PST without Outlook. It runs in your browser; nothing is uploaded.
Open PST Viewer
Keep reading

More from the blog

RecoveryBefore you repair a PST file: eight steps that protect your mailA repair changes the file it works on, and SCANPST can remove what it cannot fix. These are the steps to take first, so that whatever the repair does, you can still go back to what you had.Read the article →VerificationHow to check that a converted, repaired or imported mailbox is really complete"Completed" in a progress bar means the tool stopped without an error, not that every message arrived. A practical way to check a PST, MBOX or Microsoft 365 import against its source, what the numbers can and cannot tell you, and the traps that make honest results look wrong.Read the article →TroubleshootingEmails missing from Outlook or a PST? Check these causes before you assume they are lostMost mail that vanishes from Outlook is still there: not downloaded, filtered out of view, moved by an archive policy or searched in the wrong place. How to tell which, in the order worth checking, and what it looks like when something really is gone.Read the article →