Convert a bank statement to CSV without uploading

What is in a bank statement that you should not upload?

Payee names, card last-fours, balances, addresses, and sometimes SSN fragments in tax statements. A “free PDF to Excel” site that accepts the file has a copy of your month. Terms of service rarely help after a breach. Data minimization (GDPR Art. 5, CCPA purpose limitation) is easier when the processor is your own laptop.

How does client-side PDF-to-CSV actually work?

The page loads pdf.js in the worker. FileReader or blob.arrayBuffer() feeds the document. getTextContent() returns items with transform matrices. Grouping by rounded Y builds lines; splitting on large ΔX builds cells. For already-digital CSV/OFX, Papaparse or a text split is enough — skip PDF entirely.

const buf = await file.arrayBuffer();
const pdf = await getDocument({ data: buf }).promise;
const page = await pdf.getPage(1);
const { items } = await page.getTextContent();
// cluster items by transform[5] (y), then join str

Why do layouts break, and what should you do next?

Banks draw tables with lines that are not text. Multi-line memos wrap. Dates may be headers repeated every page. After a local parse, open the CSV editor: freeze the header, drop fee-only rows, and export again. That second pass is still in-memory.

How do you prove nothing uploaded?

Open DevTools → Network, filter Fetch/XHR, convert a statement, and confirm there is no request whose payload is the PDF. You should see the JS bundles and maybe an ad iframe — not multipart/form-data of your file. That audit is the same method we recommend for every tool on this site.

Where does the CSV go after export?

Into your downloads folder as a file you control. From there, spreadsheets, local bookkeeping, or a JSON conversion still in the browser. Do not re-upload the CSV to a second “cleaner” that undoes the privacy win.

Frequently asked questions