Security

The smallest possible attack surface

Because the live tools never upload anything, there is no storage bucket holding your documents, no processing queue and no server that could leak them. The site is static files plus the code that runs in your own browser.

File validation

Uploads are checked by extension and MIME type in the picker, and again by reading the file's magic bytes before processing — a file named .png that is really something else is detected and rejected rather than trusted.

PDFs are parsed by PDF.js with scripting disabled, so an embedded action in a malicious document is not executed. Corrupt and encrypted files produce a clear message instead of an unhandled crash.

Resource limits

Rendering is capped so a hostile file cannot request an unallocatable canvas, and long jobs yield to the browser between pages so a tab stays responsive and can always be closed.

When server tools arrive

Server-side processing will run in sandboxed workers with CPU, memory and timeout limits, behind signed download URLs with randomised storage keys and automatic deletion. The HTML-to-PDF renderer will block localhost and private network ranges to prevent SSRF. None of that is live yet, and this page will be updated when it is.