Skip to content

Security practices

Last updated

The short version. The safest file is one that never leaves your device, so many of our tools run entirely in your browser. When a tool needs our server, your file travels over an encrypted connection, is scanned for malware, and is deleted when the job ends. Every tool page says which kind it is before you choose a file.

Tools that run in your browser

These tools read your file on your own device, with code the page has already loaded. Nothing about the file — its contents, its name or its size — reaches our servers, and closing the tab discards it. The one exception is analytics, and only if you allow it: Google Analytics is then told which tool you used and a coarse size band of the result, never the file, its name or its exact size. The status page lists every tool that works this way.

Tools that use our server

Some work cannot be done in a browser: recognising text in a scan, converting office formats, and anything that uses an AI model. For these, your file is uploaded over an encrypted connection straight to our storage provider, Cloudflare R2, and is scanned for malware before any processor touches it; the status page shows whether scanning is running right now.

  • Your upload is deleted as soon as its job ends, whether it succeeded or failed. An upload that never reaches the end of a job is erased by a storage rule that runs on a daily cycle and removes uploads after they are 1 day old, so such a file can stay in storage for 1 day or longer.
  • The result's download link stops working after 60 minutes.
  • No one reads your documents. No person at pdf.xyz opens them in the ordinary course of running the service.

Passwords you type

The tools that add or remove a PDF password send the password you type with the job. Our job queue removes it when the job finishes or is cancelled — or, if no server picks it up, when the queue's retention lapses after 24 hours — and the queue's on-disk journal, on our web server, can keep a copy until it is next compacted. While the job runs, our server hands the password to the encryption tool through a temporary file in the job's own folder, which is erased when the job ends. It is never written to a log, an error message or a result. If a password is one you use elsewhere, change it, or use it only for the document.

The website itself

Traffic between your browser and this site is encrypted in transit. The site sends a Content Security Policy that limits where scripts, styles, connections and frames may come from — though it does allow inline scripts, which the site's framework uses — along with related protections against common web attacks. There are no accounts, so there is no password database to break into.

What we do not promise

No service can promise perfect security, and we do not. The largest reduction in risk is the design itself: for a tool that runs in your browser there is nothing on our servers to breach, because the file never left your device. The full account of what is collected, who handles it and for how long is in the Privacy Policy.

Reporting a security problem

pdf.xyz is operated by BENEERA LLC. If you find a vulnerability, or think a file was handled in a way this page does not describe, write to [email protected] with what you saw and how to reproduce it. Please do not test against other people's files or run load against the service.