Security
Private by design, not by promise: here’s exactly what happens to your files.
Most tools never upload
Merge, split, edit, sign, convert to Word and most other tools run entirely in your browser, using pdf.js and pdf-lib. Your file never leaves your device, so there’s nothing on our side to protect or leak.
Encrypted with a key we don’t keep
When a tool needs our server, your upload is encrypted on arrival with AES-256-GCM using a new random key for that job. The key goes back to your browser; our database stores only a hash of it. Without the key, the stored file is unreadable, even to us or to someone with a copy of the disk.
Sandboxed processing
PDF tools run in a separate container with no network access at all, no special privileges, a read-only system, and strict time, memory and file-size limits. Unencrypted copies exist only in memory while your file is processed. Web pages for HTML to PDF are loaded through a filter that blocks any private or internal address.
Deleted within the hour
Your browser deletes the job as soon as it has downloaded the result. A cleanup task removes anything left after one hour.
Web security
The site is HTTPS-only, uses a strict Content Security Policy with no inline or third-party scripts (apart from Cloudflare’s bot check on server tools), and blocks framing and cross-site requests.
Report a problem
Found a security issue? Email [email protected]. See also /.well-known/security.txt.