Security overview

How OmniPDF protects your files, and what you need to do to keep them safe.

1. Files never leave your device

This is the core security claim and worth stating clearly: no file processed by OmniPDF is uploaded to any server. All processing runs in your browser using JavaScript and WebAssembly. There is no server-side component that receives, stores or processes files.

You can verify this yourself. Open your browser's developer tools, switch to the Network tab, and process any file with any tool. You will see requests for the tool's libraries (all to omni-pdf.pages.dev) but no request that carries your file content.

2. No accounts, no credentials

OmniPDF has no login system. There are no passwords to leak, no sessions to hijack, no user profiles to steal. You arrive, you use a tool, you leave. Nothing about you is stored server-side because there is nothing to store.

3. HTTPS everywhere

The entire site is served over HTTPS with a valid TLS certificate. All communication between your browser and OmniPDF's servers is encrypted in transit. This protects against network-level attacks (man-in-the-middle, packet sniffing).

4. Strict security headers

Every response from OmniPDF includes security headers that harden the browser's defences:

• Content-Security-Policy — restricts which scripts, styles, and resources can load. Prevents XSS and code injection.
• X-Content-Type-Options: nosniff — prevents MIME-type confusion attacks.
• X-Frame-Options: DENY — prevents clickjacking by blocking the site from being embedded in an iframe on another site.
• Referrer-Policy — controls what information is sent to third parties when you click external links.
• Strict-Transport-Security — forces HTTPS for all future requests.
• Permissions-Policy — disables unnecessary browser features (camera, microphone, geolocation).

5. Self-hosted libraries

Every third-party library used by OmniPDF is self-hosted on our own domain, with pinned versions and LICENSE files included. We do not load libraries from third-party CDNs at runtime. This means:

• No dependency on third-party CDN availability or security.
• No risk of a compromised CDN serving malicious code to OmniPDF users.
• All code is auditable by inspecting our repository.

6. Password encryption is real

When you use Protect PDF or Encrypt PDF, the file is encrypted with standard AES-128 or AES-256, the same encryption used by banks and governments. The encryption happens in your browser — your password and your file never leave your device, even during encryption.

This is genuinely secure for the encryption itself. The security of the result depends on the strength of your password. Use a long, unique password generated by the PDF Password Generator and store it in a password manager.

7. Redaction actually redacts

Many "redact PDF" tools simply draw a black rectangle on top of the text. The underlying text is still in the file and can be selected, copied or extracted — sometimes without any special tool. This has caused serious real-world data leaks.

OmniPDF's Redact PDF rasterizes the page after drawing the redaction box. The output PDF contains an image of the page, not the original text. The text behind the redaction is not present in the output file.

8. No tracking of document content

Analytics events are anonymised. They record the tool name and the outcome (success/failure) but never the file name, file content, file size or any metadata from the file. We cannot see what you process.

9. What OmniPDF cannot protect you from

Browser-side processing protects your documents from OmniPDF servers. It cannot protect you from:

• Compromised devices. If your computer or phone has malware or an untrusted browser extension, your files are at risk regardless of where they are processed.
• Unsecured networks. Processing happens on your device, but if you are on a public Wi-Fi network and the page has not loaded yet, initial page loading can be intercepted if HTTPS is bypassed.
• Shoulder surfing. Physical observation of your screen is not prevented.
• Lost devices. If your laptop is stolen while the browser tab is open, the in-memory data may be recoverable by advanced forensics.

10. Recommendations

• Use a modern, up-to-date browser.
• Keep your operating system patched.
• Do not install untrusted browser extensions.
• Use HTTPS — do not ignore certificate warnings.
• Close the browser tab when done processing sensitive documents.
• Store any password-protected PDFs in an encrypted folder or password manager.
• For high-security workflows, consider using OmniPDF in a private browser window.

11. Responsible disclosure

If you believe you have found a security vulnerability in OmniPDF, please email security@omni-pdf.pages.dev with details. Do not post the vulnerability publicly before we have had a chance to respond. We will credit responsible disclosures.

12. What we do not do

• We do not retain files. We cannot — we never receive them.
• We do not log document contents.
• We do not sell or share user data. We have no user data to sell.
• We do not use tracking pixels that follow you across the web.
• We do not require third-party cookies to function.