Skip to content
ezyPDF

Security

This page describes the concrete security measures in place, and is updated when they change.

Transport and headers

Cross-Origin-Embedder-Policy is deliberately not applied site-wide. It would break the ad and measurement scripts and offers no benefit here, since no tool depends on SharedArrayBuffer.

  • HTTPS everywhere, with HTTP Strict Transport Security (HSTS) including subdomains and a two-year max-age.
  • A Content-Security-Policy that restricts script, style, image, font, and connection sources to this origin and the small set of measurement domains we actually use.
  • frame-ancestors 'none' so the site cannot be embedded in another page, backed by X-Frame-Options for older browsers.
  • X-Content-Type-Options: nosniff, a strict-origin-when-cross-origin referrer policy, and a Permissions-Policy that switches off camera, microphone, geolocation, and payment access.

How files are handled

  • Files are validated by reading their leading bytes (magic bytes), not by trusting the extension, so a renamed file is rejected.
  • Office formats are ZIP containers, so we cap the number of entries, the size of any single entry, and the total uncompressed size to defend against compression bombs.
  • Filenames are stripped of path separators and control characters before being used for a download.
  • Text extracted from documents is inserted as text nodes, never as HTML, so a document cannot inject markup into the page.
  • Object URLs are revoked after use and large buffers are released once a job finishes.

Dependencies

PDF processing uses pdf-lib and pdf.js, both bundled and served from this origin rather than a public CDN, at pinned versions. The PDF.js worker and the fonts we embed are served from this domain too, so no third party sees which document you are working on.

What we deliberately don't offer

We do not currently provide PDF password protection or password removal. This is not because encryption is impossible in a browser — it is because we have not shipped an implementation we have verified across browsers, and a half-working encryption feature is worse than none. The tool pages for those features explain what a verified implementation would require.

We also offer no feature for discovering or bypassing a password on a document you cannot open.

Reporting a problem

If you find a security issue, please email us with enough detail to reproduce it and give us a reasonable window to fix it before disclosing publicly. Do not include real personal documents in a report.