Security

Last updated 22 October 2026

How the tools work

When you open a tool, your browser downloads the tool’s program from pdfandphoto.com, the same way it downloads any web page. After that, everything happens on your phone or computer. Your PDFs and photos are read, changed and saved by your browser on your device. They are not sent to us or to anyone else.

Your browser enforces it

Every page we send carries a security rule, called a Content Security Policy, that tells your browser:

• run program code only from pdfandphoto.com, never from anywhere else;
• let the page connect only to pdfandphoto.com, so no file or text can be sent to another website (connect-src 'self');
• never show our pages inside another website, a trick used by fake sites that try to get people to type in passwords (frame-ancestors 'none').

These rules are applied by your browser, not by us, so they hold even if a mistake ever slipped into our code.

One exception: on the Remove background and passport photo pages, on the pages that read text from photos and scans (OCR), and in these tools’ own files, the rule also lets your browser run WebAssembly (fast, compiled program code, 'wasm-unsafe-eval'), because the background remover needs it to find the subject of your photo and the text reader needs it to read the text. That code still comes only from pdfandphoto.com, and these pages still can’t send anything to any other website.

Check it yourself in two minutes

• Flight mode test. Open a tool and add a file, so the tool has loaded. Then switch on flight mode or unplug from the internet, and add another file. It keeps working, because nothing needs to be sent anywhere.
• Watch the traffic. On a computer, press F12 to open the browser’s developer tools and choose the Network tab. Use any tool: you’ll see the page load its program files, and no request that carries your file.
• Read the rule. In the same Network tab, click the first line (the page itself), open Headers, and look in the part the server sent (Response Headers) for Content-Security-Policy.

Or run the test right here

This button makes this page try four things a leaky website would do: send data to another website, load a tracking image, send a background message, and load program code from elsewhere. It aims them at block-test.invalid, an address that can never exist, so nothing could arrive even if a test got through. Then it shows what your browser did.

Run the block test

What stays on your device, and for how long

• Files you add exist only in the open page. They are gone when you close it.
• The site’s own program files are kept by your browser after your first visit, so pages open faster and work offline. They contain no files or details of yours.
• The background remover (about 6 MB, used by Remove background and the passport photo maker) is downloaded only after you agree, and then kept by your browser so it isn’t downloaded again. It contains nothing of yours.
• The text reader (OCR, which reads text from photos and scans: about 1.1 MB, plus 0.5 to 2 MB for each language you choose) is downloaded only after you agree, and then kept by your browser so it isn’t downloaded again. The languages you last chose are remembered in this browser. None of it contains anything of yours.
• Invoice and quote makers: your business details, logo and notes, and the invoice or quote you’re working on (customer and items), are kept in this browser on this device so you can carry on later. Tap “Forget my details on this device” on either maker to remove everything both makers keep.
• A PDF passed from the PDF viewer to another tool is held in this browser’s own storage until the next tool opens it, or until you pass on another PDF.
• Passwords you set with Protect PDF never leave your device. The PDF is locked with AES-256, the strongest standard PDF encryption. We can’t recover a forgotten password.

What our server sees

Our server delivers the pages and keeps standard technical logs: your IP address (the number that identifies your internet connection), browser type, the page requested and the time. It never receives your files. This version of the site uses no accounts, no visitor-statistics tools (analytics) and no advertising code. If that changes, our privacy policy will say so first.

Connection

The site is served only over an encrypted https connection, and your browser is told to always use it.

For businesses and IT teams

Because files are processed on your staff’s own devices, documents such as contracts, statements and ID copies stay inside your organisation. If you need anything for your own security review, such as answers to a questionnaire, email hello@pdfandphoto.com. We are planning business plans for teams: see For business.

Reporting a security problem

If you think you’ve found a security problem, email hello@pdfandphoto.com. Please give us a reasonable time to fix it before making it public. Our contact details are also published in /.well-known/security.txt, the standard place where security researchers look for them.