Skip to the content
PDFhq

How pdfhq works

Every tool runs inside your browser. This page names the engines that do it, the licenses they carry, and the way to prove for yourself that nothing is sent anywhere.

What runs where?

All of it runs in your browser. The engines are compiled to WebAssembly and loaded into the page, so opening a file hands it to code that is already running on your machine, and the result is written back without a network request in between.

Heavy work happens in web workers rather than on the page’s main thread, which is why the interface keeps responding while a two-hundred-page document is being rewritten. There is no processing server in this product: we operate none, so the question of what a server keeps does not arise.

Which engine does what?

Six of them, each doing the job it is best at. Every one is open source under a permissive license, and every one is served from this domain rather than fetched from somewhere else at the moment you need it.

The engines loaded into the page, their licenses, and the exact builds we serve.
EngineWhat it doesLicenseBuild
qpdfStructure, encryption, linearization and repairApache-2.0qpdf 12.2.0
PDFiumRendering pages, reading text runs, images and form fieldsBSD-3-Clause@embedpdf/pdfium 2.15.0
pdf-libAssembling documents, drawing, and filling formsMIT@cantoo/pdf-lib 2.8.2
TesseractCharacter recognitionApache-2.0tesseract-wasm 0.11.0
mozjpegReproducible image re-encoding for compressionBSD-3-Clause@jsquash/jpeg 1.6.0
node-signpdfCertificate signaturesMIT@signpdf 3.3.0

Why do you build qpdf yourselves?

Because the ready-made WebAssembly build cannot repair a damaged file. qpdf recovers a broken cross-reference table by catching the error its parser raises, and that build has C++ exceptions compiled out, so the recovery code can never run. We measured it across eleven kinds of damage, including the most trivially repairable one there is, and it failed on every single one.

So we compile qpdf 12.2.0 ourselves, from unmodified upstream source with WebAssembly exceptions enabled, in a container pinned by digest and from a source archive pinned by checksum. The build is reproducible, qpdf’s license and notice files ship beside the binary, and your browser checks that binary against its expected hash before running it. Repair now rebuilds the tables it should, and a file that is genuinely beyond recovery says so rather than failing quietly.

How do I check that nothing is uploaded?

In your own browser, in about thirty seconds, using nothing that is not already in it. Do this with a file you do not mind opening, and watch what the page does.

  1. Open the developer tools in your browser and switch to the Network panel. In Chrome, Edge and Firefox that is F12; in Safari, enable the Develop menu first.
  2. Clear the list, then filter it to Fetch and XHR so you are looking at data requests rather than images and stylesheets.
  3. Drop a PDF onto any tool on this site and run it through to the finished result, including the download.
  4. Read the list. Requests for engine binaries from this domain appear the first time you use a tool, and nothing carrying your document appears at any point.

Is there a stronger test?

Yes, and it is quicker. Use a tool once so the engines are cached, then disconnect from the network entirely and use it again. The job finishes offline, which is only possible because your file never needed to go anywhere.

What is cached, and for how long?

The interface and the engine binaries. Each binary lives at an address that includes its version, so a new build is a new address and a cached one can never go stale. They are held for a year and shared by every tool that uses the same engine.

Documents are never cached. Nothing you open and nothing you produce is written to storage by this site, so clearing the cache costs you one download and loses no work.

What can this suite not do?

Enough to be worth writing down. Everything below is a real boundary rather than a gap we mean to close next month, and where a tool runs into one it says so on the tool as well.

What if something here is wrong?

Tell us and we will correct it. The engine versions, licenses and limits on this page are checked against the builds we actually serve, and the date under the heading moves when the words do. A correction goes through the contact form.