Security

Every claim on this page is something you can check yourself. Where a claim has a limit, the limit is stated rather than left out.

The short version

Your PDF is opened and processed by JavaScript running in your browser tab. It is never sent anywhere. There is no upload endpoint, because there is no server-side application at all — the site is a set of static files, and the only thing our host ever receives is the request for the page itself.

How to verify it yourself

You do not have to take our word for any of this. Three checks, none requiring special tools:

1. Watch the network while you work. Open your browser's developer tools (F12), switch to the Network tab, then load a PDF into any tool and export a result. You will see requests for the page, its scripts and styles — and no request carrying your file. Nothing is uploaded, so there is nothing to find.
2. Read the security policy header. In the Network tab, click the request for the page itself and look at the response headers. TheContent-Security-Policy contains connect-src 'self'. That instructs your browser to block any outbound connection to another origin — so even if the page tried to transmit something to a third party, the browser would refuse it.
3. Disconnect, then keep working. Load the page and open your file, then turn off your connection and export. The export still completes, because building the new PDF happens in the page with no network involved. The first load needs the network to fetch the page and its code, and OCR needs it once to fetch its language model — but the operation on your document does not.

What is stored on your device

The site itself stores nothing. It sets no cookies, and writes nothing to local storage, session storage or IndexedDB. There is no account, no session, and no draft saved anywhere. Close the tab and the document is gone from memory.

There is one exception, and it is worth being precise about. OCR uses a local recognition engine whose English language model is roughly 2.8 MB. The first time you run OCR, that model is downloaded from this site and then cached in your browser's IndexedDB so it does not have to download again. What is cached is the language model, not your document — the same way a browser caches a font.

OCR is the one feature that needs the network

OCR downloads its engine and language data from this site on first use — around 6.5 MB in total. That is application code, not your file. Your document is still read and recognised entirely inside your browser, and is never transmitted. We mention it because "no network requests at all" would be inaccurate, and we would rather be exact than sound better.

What we and our host can see

We run no analytics. There is no Google Analytics, no advertising script, no error-reporting service, no session recorder, and no third-party script of any kind loaded from another domain.

The site is served through Cloudflare. Like any web host, Cloudflare receives the ordinary metadata of an HTTP request: your IP address, your browser's user agent, and which URLs you requested. That is a property of how the web works, not something specific to this site.It does not include your document, because your document is never part of any request. Cloudflare also rewrites the support email address on our pages into a script-decoded form to reduce scraping.

Passwords

Passwords used by Protect PDF andUnlock PDF exist only in the page's memory for the duration of that operation. They are not written to any browser storage, not included in any log, and not transmitted — there is nowhere for them to be transmitted to. If you forget a password you set, we cannot recover it, because we never had it.

Every PDF is treated as untrusted input

A PDF is a program-like format, and files from other people should be treated with care. Before a file is handed to any parser, it is validated against the actual PDF file signature in its opening bytes — never the filename or extension alone, since either can be renamed. Empty files, files that are not really PDFs, and files large enough to risk exhausting your device's memory are each reported with a specific message.

Embedded PDF JavaScript is not executed. The renderer's scripting support is off, which is its default, and we never turn it on.

Security headers

Served on every page, and visible to you in the response headers:

• Content-Security-Policy — restricts where scripts, styles and connections may come from; connect-src 'self' blocks outbound connections to other origins.
• Strict-Transport-Security — requires HTTPS for a year.
• X-Frame-Options: DENY and frame-ancestors 'none' — the site cannot be embedded in another page, which prevents clickjacking.
• X-Content-Type-Options: nosniff — stops the browser guessing file types.
• Referrer-Policy: strict-origin-when-cross-origin — limits what is disclosed when you follow a link away.
• Permissions-Policy — camera, microphone, geolocation, payment and USB are switched off for this site.

Limits of browser processing

Working in the browser has real constraints. Very large documents can exceed the memory your device makes available to a tab, and some unusual PDF constructs are not fully supported. Interactive form fields and embedded certificate-based signatures may be altered or dropped when pages are copied into a new document. Where a document cannot be processed safely, the aim is a clear error rather than a silently wrong file.

What we do not claim

No system, ours included, can promise absolute security. Specifically, we do not claim that the site makes no network requests at all (it loads its own code, and OCR loads its model), that it works offline before it has loaded, that every PDF feature survives every operation, or that a visible signature added here carries the legal weight of a certificate-based digital signature. Reviewing an important document before you rely on it remains your call.

Reporting a security issue

If you believe you have found a vulnerability, or a statement on this page that is not accurate, email [email protected]. Corrections to this page take priority over new work — see oureditorial policy for how we handle them.