Security

Last updated: 2026-06-08

Browser-side processing

All current PDFCraft tools process your file in your browser using JavaScript. The file is read from your device's memory, processed locally, and the result is downloaded directly to your device. Your PDF or image is not uploaded to any server.

File handling limits

• Maximum PDF file size: 50 MB.
• Maximum image file size: 20 MB each.
• Maximum combined upload: 100 MB.
• Maximum files for Merge PDF: 50.
• Maximum images for Image-to-PDF: 100.

Validation

We check the file extension, the MIME type, and the PDF header before any processing happens. Files that look corrupted or that are not valid PDFs or supported image formats are rejected with a clear error message.

Server-side processing (future)

For tools that cannot run reliably in the browser (for example, Word/Excel/PowerPoint conversion or OCR), we plan to use isolated worker containers with the following safeguards:

• Temporary, randomized file names — no public URLs.
• Files deleted automatically as soon as the conversion completes.
• Conversion runs as a non-root process inside an isolated container.
• Strict per-job memory, CPU, and time limits.
• Rate limiting per IP to prevent abuse.

No permanent storage

PDFCraft does not permanently store your converted files. Output files exist only inside your browser tab until you download them or close the tab.