Security and file processing
This page describes what actually happens to a file when you use this site. It is written to be checkable rather than reassuring, so where a claim would be convenient but untrue, it is not made.
The short version
Every tool that currently works runs entirely in your browser. Your file is read by JavaScript on the page, processed in memory, and written back to your downloads folder. It is not uploaded, because there is nowhere to upload it to: this build has no file storage, no processing server and no database.
That means we cannot delete your files after a period, because we never had them. Claims about automatic deletion appear on a lot of PDF sites; here they would be meaningless.
How to verify it
Open your browser’s developer tools, switch to the Network tab, and use any tool on this site. You will see the page and its scripts load. You will not see your file go anywhere. This is the only kind of privacy claim worth making, because you can check it yourself in about thirty seconds.
Processing mode by tool
Every tool in the registry carries a processingMode field, and the badge shown on each tool page is generated from it rather than written by hand.
- Local, runs in your browser. 67 tools.
- Server, would send your file somewhere. Currently none.
- Hybrid, partly both. Currently none.
- Not built, listed, explained, and does nothing. 0 tools.
What is stored in your browser
Nothing, in this build. Files exist only in the memory of the tab you are using and are discarded when you navigate away or close it. There is no local storage of document content, and object URLs created for previews and downloads are revoked once used.
Analytics
The analytics layer is disabled unless a provider is configured. If one is, the events recorded are limited to which tool was opened and whether processing succeeded, failed or was cancelled. File names, file contents, page counts, extracted text and any passwords or signatures are never included in an event. That is enforced by the shape of the event type in src/lib/analytics.ts, which is a closed union with no free-form payload: there is no field a file name could be written into, so it is not a promise that depends on anyone remembering to keep it.
Passwords and encrypted documents
Encryption and decryption run through qpdf compiled to WebAssembly, in this tab. Your password is used to derive a key and then discarded; it is never transmitted, logged or stored, which also means nobody here can recover it for you.
Encrypted documents are detected by the other tools and refused rather than partially processed, with a pointer to Unlock PDF. Password recovery is not offered and will not be: it means brute force, and a tool that opens documents without their password is a tool for reading other people’s documents.
What this model cannot do
Being honest about the architecture means being honest about its limits. Converting to Word or Excel, rendering Office documents and reading text off a scan all need work that cannot currently be done in a browser tab. Those tools are listed with an explanation rather than quietly omitted, so you can see the shape of what is missing before you need it.
Headers and hardening
The application sets a Content Security Policy, denies framing, disables MIME sniffing and restricts referrer information. Uploaded file names are sanitised before being used in downloads so that a crafted name cannot inject markup or escape a directory.
Reporting something
If you find a security problem, the contact form reaches a person. Please describe the issue rather than sending a file that demonstrates it.