Architecture is the security model
The strongest security control on this site is its architecture:
- Static website — there is no application server to attack or compromise.
- No uploads — files are processed by JavaScript in your browser.
- No accounts — nothing to steal, no credentials to phish.
- No database — no user data exists to leak.
Local processing
PDF parsing and processing use well-known open-source libraries (pdf-lib, pdf.js, Tesseract via WebAssembly) executed on your device. Network requests never carry your document.
You can verify this: open your browser's developer tools (Network tab) and process a file. No request contains your file's data.
Supply chain
All runtime libraries and assets — including the OCR engine and fonts — are bundled with the site. There are no CDN dependencies that could be compromised to inject scripts.
Tools with security implications
Some tools handle sensitive operations:
- Protect PDF encrypts with standard PDF encryption. Use a strong password.
- Redact PDF covers content visually — for certified removal, rasterize the output.
- Remove JavaScript and Sanitize PDF strip risky elements from documents.
- Check PDF Security inspects files before you open them.
Read each tool's limitations.
Honest limitations
- PDF password protection limits casual access but is not unbreakable.
- Visual redaction does not remove underlying text from the file.
- Local processing depends on your browser and device security. Use a trusted browser and keep your OS updated.
Reporting vulnerabilities
Found a security issue? Report it via the Report a Problem page. Include the tool, the browser and reproduction steps.