About

Tools that do not ask for your document

Most document tools ask you to upload a file to a company you have never heard of, then promise to delete it. This one cannot ask, because there is nowhere to send it.

Why it is built this way

Browsers can now do the work that used to need a server: read a PDF, draw its pages, write a new file. Once that is true, uploading a contract, a bank statement or a passport scan to a stranger's server is a risk with nothing to buy. So the tools here run in your browser, and the site is a set of static files with no backend to receive anything.

Why you should not simply believe that

“Your files never leave your browser” is a sentence anyone can write, and plenty of sites write it while uploading. Do not take our word for it: open your browser's network panel while you use a tool, or put the device in airplane mode after the page has loaded and watch the tool keep working. The claim is checkable, which is the only kind worth making.

You will see requests that are not this site's own code, and they go to exactly one place: our page-view counter at analytics.pagefabrica.com, which is sent the address of the page and nothing from your file. It is named here because the front page counts it, rather than being quietly left out of a number that would otherwise read better. What it receives is set out in full.

How it is paid for

Advertising, placed away from the tools and never between a control and its result. There is no paid tier and no upsell, and nothing about your document is used to select an advertisement — the document is never seen by this site, let alone by an advertiser.

The rule about what gets built

Nothing ships here until it can prove its own result. That rule delayed password protection for a long time, because the honest answer to “is the encryption sound?” was “nobody here has read the code that would do it”.

So somebody read it. The library this site already used for writing PDFs turned out to encrypt after all — the capability is in its source and in none of its documentation, which discusses only how to open an encrypted file. It was then measured rather than trusted: a protected document declares AES-128 under the standard security handler, its text does not appear anywhere in the bytes, and a completely separate library refuses to open it until the password is supplied. Those measurements are held by a test that runs on every build, in four browsers.

The tool ships with the limit stated instead of hidden. It is AES-128, not AES-256; the same library can write a newer revision, but that revision is a withdrawn draft whose password check is weaker than what ships. And because that encryption's key derivation is cheap to run over a list of guesses, the strength of the file is the strength of the password — which is why the tool refuses ones that would make the protection a fiction, and why it re-opens every finished file to check the protection is real before offering it to you.