Security

Most tools never send your file

Most of our tools work entirely in your browser, on your own device: Merge (PDF files and images), Split, Rotate, Protect, Sign, and Edit for PDF files; the image converters, compressor, and resizer; the GIF maker and compressor; ZIP extraction; text, math, QR code, and developer tools. Your file is not uploaded anywhere.

You can check it yourself: open your browser's developer tools, "Network" tab, and use the tool — no request carries your file.

When you choose "Continue with…" under a result, the file goes to the next tool in your browser's memory: it is not uploaded and not stored.

When a tool needs a server

Some tools need more computing power than a browser has: for example Compress PDF, Repair PDF, PDF to PDF/A, Excel, PowerPoint and HTML to PDF, several video tools, Background Remover, and Merge PDF for the Word, Excel, and PowerPoint files you add to it. Their page says so. These files go to our own servers, run by us (hosted by Railway), and are not shared with any other company.

Deletion: the file you send is deleted as soon as processing ends. The result is deleted right after you download it, or automatically after 15 minutes if you never do.

Our logs: our code writes nothing about a file — name, content, or metadata — to them.

Specialized providers, named

A few tools send your file or text to a specialized provider, through our server. We name them, and each tool's page says which one it uses:

• ConvertAPI (Lithuania): Word to PDF for .docx files (also when added to Merge PDF), PDF to Word, PDF to Excel, PDF to PowerPoint — files are sent with storage disabled and are not kept by ConvertAPI.
• OpenAI (USA): the AI text, image, and transcription tools — data sent through OpenAI's API is not used to train their models.
• Pangram Labs (USA): AI Detector.
• Google Cloud Translation (USA): Translate PDF in "Whole PDF" mode — Google returns the translated PDF and does not keep the file.

Encrypted in transit

Every connection to our site uses HTTPS (TLS), and browsers are told to never use an unencrypted connection to it (HSTS). Our site also talks to our servers and to the providers above over HTTPS. Between two of our own servers, a file travels inside our host's private network, never over the public internet.

No account required

No tool requires an account, an email address, or a payment. An account is optional: it only holds your name and email address, managed by our authentication provider (Supabase), which stores your password in hashed form.

Protection against abuse

To keep the tools free and available, our servers limit how many files one connection can process in an hour and in a day. To count, we keep a hash of your IP address instead of the address itself, for 2 days. Our processing servers accept work only from our own site: a secret key, or a single-use ticket our site issues for each large upload.

What we never do

We never sell your files or text, never use them to train any model, and never look at them.

Report a security problem

If you find a security problem on this site, please write to contact@onlineconvertools.com.