Security

Security model

A security model built on architecture: your files never leave your device.

Architecture is the security model

The strongest security control on this site is its architecture:

  • Static website — there is no application server to attack or compromise.
  • No uploads — files are processed by JavaScript in your browser.
  • No accounts — nothing to steal, no credentials to phish.
  • No database — no user data exists to leak.

Local processing

PDF parsing and processing use well-known open-source libraries (pdf-lib, pdf.js, Tesseract via WebAssembly) executed on your device. Network requests never carry your document.

You can verify this: open your browser's developer tools (Network tab) and process a file. No request contains your file's data.

Supply chain

All runtime libraries and assets — including the OCR engine and fonts — are bundled with the site. There are no CDN dependencies that could be compromised to inject scripts.

Tools with security implications

Some tools handle sensitive operations:

Read each tool's limitations.

Honest limitations

  • PDF password protection limits casual access but is not unbreakable.
  • Visual redaction does not remove underlying text from the file.
  • Local processing depends on your browser and device security. Use a trusted browser and keep your OS updated.

Reporting vulnerabilities

Found a security issue? Report it via the Report a Problem page. Include the tool, the browser and reproduction steps.