How these tools work

What each tool actually does

Ten tools, each doing one job, built from four open-source libraries: Mozilla's pdf.js reads and draws PDF pages, pdf-lib writes and encrypts new ones, docx writes Word files and jsPDF typesets them. All four are listed, with their licenses, on the licenses page.

No tool downloads a library it does not need. Merging, splitting, compressing and password-protecting never load the page renderer at all, which is why they are roughly a third of the weight of the tools that draw pages.

• Redact draws every page as an image, paints your marks onto those pixels, and builds a new document from the images alone.
• Merge and split copy pages, with their fonts and images, into new documents. Nothing is re-drawn, so nothing loses quality.
• Compress re-encodes the photographs inside a document and leaves the text alone. It does not turn pages into pictures.
• Protect encrypts the document with AES-128 under the standard security handler, then re-opens the finished file to check that it is really protected.
• PDF to Word and PDF to Markdown read the positioned text a PDF stores and infer structure from size, weight and alignment — the same inference for both, so they cannot disagree.
• PDF to image uses the same drawing step as redaction and hands you the pictures.
• Images to PDF embeds JPEG and PNG data untouched into a new document.
• HTML to PDF parses markup as data and typesets it. It never renders your markup, so nothing in it can run.

Where the work happens

In your browser tab, on your device. These pages are static files served from a web host; there is no application server behind them and no endpoint that accepts a document — not a slow one, not a rate-limited one, not one that deletes after an hour. Each tool downloads its own code the first time you use it, and after that the file you choose is read by that code, in memory, on your machine.

The heavy work runs in a background thread, so the page stays responsive and a long document does not freeze the tab. If your browser cannot start that thread, the tool says so and runs in the page instead, more slowly.

What does leave this device

One thing does, and it is not your document: a page-view counter, served by our own analytics at analytics.pagefabrica.com, which is sent the address of the page you are on and one of three named events — the tool's interface became ready, a job produced its result, or a finished file failed its own check. It sets no cookie, creates no identifier, honours Do Not Track, and receives nothing about your document, because the code that sends those events accepts three names and refuses every property.

The “Requests off this site” count includes that request. The number in the row of marks is measured in your own tab from the browser's resource timings, and it counts every request that left this origin including our own analytics — a counter that hid the one request this site makes would be worth less than no counter at all.

How the redaction check is performed

After the redacted document has been built, it is opened again from its own bytes, exactly as a stranger receiving the file would open it. Then five things are measured:

1. every phrase covered by a mark is searched for in the text of the finished file — the result must be zero matches;
2. the finished file must yield no extractable text at all, on any page;
3. it must contain no annotations, no form fields, no attachments and no document scripts;
4. it must have the same number of pages it started with;
5. each marked rectangle is sampled pixel by pixel in the finished page image and must be solid black.

If any of these fails, no download is offered at all.

How the password protection is checked

The password tool proves itself the same way, because a file somebody believes is protected and is not is worse than one that never claimed to be. After the document has been encrypted, the finished bytes are re-opened five times over:

1. the file must declare standard PDF encryption in its own trailer;
2. opening it with no password must fail;
3. opening it with the password you chose must succeed;
4. a run of the original page content, kept before anything was encrypted, must be absent from the finished bytes;
5. it must have the same number of pages it started with.

If any of these fails, there is no download.

What we deliberately leave out

Redaction removes what you mark. It cannot know what is sensitive, so a name you did not mark stays in the document — read the result before you send it. Because pages become images, the finished file is larger and its text can no longer be selected or searched.

Markdown and Word conversion need a text layer. Scanned pages hold a picture of text and cannot be converted by any means other than OCR, which these tools do not perform. Structure in a converted document is inferred from layout, so headings and tables are a good guess rather than a fact, and the layout itself — fonts, colours, columns, headers and footers — is not carried into Word at all.

Image conversion is limited by your device's memory. A long document at 300 dpi may fail on a phone; the tool will say so rather than produce a broken file.

Compression works on the photographs inside a document and nothing else, so a PDF of pure text has almost nothing to give up. When the saving is not worth a second copy, no file is offered and the reason is named.

Password protection is AES-128, the standard security handler at revision 4 — the encryption every PDF reader made since 2005 can open. It is not AES-256, and we will not imply that it is: the library used here can also write revision 5, but revision 5 is Adobe's withdrawn Extension Level 3 whose password check is a single SHA-256, which makes it faster to attack than the revision 4 that ships. The revision 6 that PDF 2.0 standardised is not implemented by it at all, and reaching it would mean shipping about 670 KB of extra WebAssembly for one feature. If AES-256 is your requirement, use a desktop tool — this one does not have it.

What that means in practice: the file is genuinely encrypted, and the strength of the encryption is the strength of the password. Revision 4 derives its key with 50 rounds of MD5, which a laptop can run millions of times a second over a list of guesses. That is why the tool refuses an empty password, anything under six characters, and short runs of digits — and why a passphrase of several words is worth far more here than a clever short one.

How to use the result

Treat the redaction check as what it is: a proof that the marked text is gone from the file, not a judgement that the file is safe to publish. Look at the finished document before sending it, and keep your original — the redacted copy is the one to share, not the one to archive.

If a tool gets something wrong, tell us what the document looked like. Do not send the document.