How pdfhq works
Every tool runs inside your browser. This page names the engines that do it, the licenses they carry, and the way to prove for yourself that nothing is sent anywhere.
What runs where?
All of it runs in your browser. The engines are compiled to WebAssembly and loaded into the page, so opening a file hands it to code that is already running on your machine, and the result is written back without a network request in between.
Heavy work happens in web workers rather than on the page’s main thread, which is why the interface keeps responding while a two-hundred-page document is being rewritten. There is no processing server in this product: we operate none, so the question of what a server keeps does not arise.
Which engine does what?
Six of them, each doing the job it is best at. Every one is open source under a permissive license, and every one is served from this domain rather than fetched from somewhere else at the moment you need it.
| Engine | What it does | License | Build |
|---|---|---|---|
| qpdf | Structure, encryption, linearization and repair | Apache-2.0 | qpdf 12.2.0 |
| PDFium | Rendering pages, reading text runs, images and form fields | BSD-3-Clause | @embedpdf/pdfium 2.15.0 |
| pdf-lib | Assembling documents, drawing, and filling forms | MIT | @cantoo/pdf-lib 2.8.2 |
| Tesseract | Character recognition | Apache-2.0 | tesseract-wasm 0.11.0 |
| mozjpeg | Reproducible image re-encoding for compression | BSD-3-Clause | @jsquash/jpeg 1.6.0 |
| node-signpdf | Certificate signatures | MIT | @signpdf 3.3.0 |
Why do you build qpdf yourselves?
Because the ready-made WebAssembly build cannot repair a damaged file. qpdf recovers a broken cross-reference table by catching the error its parser raises, and that build has C++ exceptions compiled out, so the recovery code can never run. We measured it across eleven kinds of damage, including the most trivially repairable one there is, and it failed on every single one.
So we compile qpdf 12.2.0 ourselves, from unmodified upstream source with WebAssembly exceptions enabled, in a container pinned by digest and from a source archive pinned by checksum. The build is reproducible, qpdf’s license and notice files ship beside the binary, and your browser checks that binary against its expected hash before running it. Repair now rebuilds the tables it should, and a file that is genuinely beyond recovery says so rather than failing quietly.
How do I check that nothing is uploaded?
In your own browser, in about thirty seconds, using nothing that is not already in it. Do this with a file you do not mind opening, and watch what the page does.
- Open the developer tools in your browser and switch to the Network panel. In Chrome, Edge and Firefox that is F12; in Safari, enable the Develop menu first.
- Clear the list, then filter it to Fetch and XHR so you are looking at data requests rather than images and stylesheets.
- Drop a PDF onto any tool on this site and run it through to the finished result, including the download.
- Read the list. Requests for engine binaries from this domain appear the first time you use a tool, and nothing carrying your document appears at any point.
Is there a stronger test?
Yes, and it is quicker. Use a tool once so the engines are cached, then disconnect from the network entirely and use it again. The job finishes offline, which is only possible because your file never needed to go anywhere.
What is cached, and for how long?
The interface and the engine binaries. Each binary lives at an address that includes its version, so a new build is a new address and a cached one can never go stale. They are held for a year and shared by every tool that uses the same engine.
Documents are never cached. Nothing you open and nothing you produce is written to storage by this site, so clearing the cache costs you one download and loses no work.
What can this suite not do?
Enough to be worth writing down. Everything below is a real boundary rather than a gap we mean to close next month, and where a tool runs into one it says so on the tool as well.
Compression does not shrink fonts
No permissive engine subsets embedded fonts reliably, so no setting here claims to. On a text document carrying several typefaces that leaves a floor: rewriting the file removes duplicated and unused objects, and the fonts themselves stay exactly as they are.
Repair recovers structure, not content
A damaged cross-reference table is rebuilt and the document opens again, which covers most files a reader refuses. A file whose objects or trailer are genuinely gone cannot be reconstructed from nothing, and repair reports that instead of producing a plausible-looking result.
HEIC depends on your browser
HEIC photographs are decoded by your browser’s own image support rather than by a library we ship, because every available one carries a copyleft license this project does not use. That works on Apple devices, which is where these files come from; elsewhere the tool says plainly that it cannot decode the file and points at the JPEG route.
Extraction reads some image formats, not all
Saving the pictures out of a PDF works for JPEG photographs and for the lossless streams that carry screenshots, charts and logos. JPEG 2000, CCITT fax, LZW, indexed palettes and CMYK separations need decoders no permissive library gives us, or a colour transform that would guess at the result, so those images are counted and skipped — and the tool says they could not be decoded rather than pretending the document has no pictures in it.
Editing text adds and covers, it does not reflow
A PDF records where each glyph sits rather than the sentence it belongs to, so replacing a word cannot push the rest of the line along. The editor places new text and covers old text, which handles corrections and fills; it does not re-lay-out a paragraph, and nothing that claims to is doing anything else.
OCR gives you a searchable layer, not a transcript
Recognition accuracy is decided by the scan. A clean 300 DPI page of printed type comes back close to perfect; handwriting, angled photographs and faint scans do not. Read the result before you rely on it, because recognition cannot tell you when it was wrong.
Office formats are not converted
Word, Excel and PowerPoint conversion needs an office engine that cannot run in a browser at any sensible size, so it is not offered here. Converting them elsewhere and bringing the PDF back is the honest route, and it keeps the promise that nothing on this site is uploaded.
Very large files are bounded by your device
Processing happens in your browser’s memory, so a phone will refuse a document a laptop handles comfortably. Where a job is close to the limit the tool says so before it starts rather than failing halfway, and splitting the document first is usually the way through.
What if something here is wrong?
Tell us and we will correct it. The engine versions, licenses and limits on this page are checked against the builds we actually serve, and the date under the heading moves when the words do. A correction goes through the contact form.