Security & how to verify it

1. The airplane-mode test (anyone can do this)

1. Open any page on this site and wait for it to load.
2. Turn on airplane mode, or disconnect from Wi-Fi.
3. Drop your PDF into the box. It opens anyway.

This shows the conversion itself doesn't need a server. It's a quick check, not a proof. The technical checks below go further.

2. How it's built

• A separate website for the converter. The converter runs on convert.cantopenpdf.com, isolated from this site by your browser's same-origin rules. Scripts on this site, including our analytics, can't read your file. That host serves static files only and has no server code.
• No third-party hosted or tracking scripts. No ad networks, no Google Analytics, no CDNs. Every script is served from our own domains. The PDF engine, Mozilla's pdf.js 6.4.299, is third-party open-source code that we host ourselves, unmodified and pinned to an exact version.
• Read-only pages. Embedded PDF scripts never run, document links aren't followed, and form fields and buttons are disabled.
• No cookies or device storage. Neither site sets cookies or uses local storage, session storage or IndexedDB.

3. What the security policy does, and doesn't do

The converter's Content-Security-Policy includes default-src 'none', connect-src 'self', form-action 'none' and frame-src 'none'. Your browser enforces it. It:

• blocks the page from making network connections (fetch, XHR, WebSocket) to any host other than the converter's own static host
• blocks form submissions and loading scripts, frames or plugins from anywhere else

It doesn't, on its own, prove that no data could ever leave your device:

• Requests to the converter's own host are still allowed, for example to load fonts.
• It doesn't govern messages the converter sends to this site (see section 4) or links you choose to follow.
• It can't protect against browser extensions or malware already on your device.

Our guarantee is that our code doesn't send your document anywhere. The policy is an extra layer that limits the damage if something went wrong.

4. Exactly what the converter tells this site

The converter sends this page short messages so we can show relevant help and count what works. Each message can contain only:

• an event name (file opened, displayed, failed, incomplete, password needed, print requested)
• a document type from a fixed list built into the code, for example sars:audit, ircc:imm5257, unknown
• the number of pages, a size range (such as “0.5–2 MB”), and whether the file was an XFA form

The converter never sends text, names, numbers, reference codes or field values from your document, and anything outside the fixed list is reported only as unknown. This site checks every message against the same list before recording it. See post() in app.js and the list in catalog.js.

This site records those events, plus the page you're on and how you arrived (campaign tags, referring site, country and device type), with a random visit ID that lives only in the page and in the link to our help form. It isn't stored on your device and isn't reused on later visits. Details are in the privacy notice.

5. Check it yourself (technical)

• See the policy: curl -sI https://convert.cantopenpdf.com/ | grep -i content-security-policy
• Open your browser's developer tools, go to the Network tab, and convert a file. The only requests go to convert.cantopenpdf.com for the app's own static files.
• Our code isn't minified. Read app.js, detect.js and catalog.js directly.
• Compare pdf.js with the official package: npm pack [email protected], then shasum -a 256 package/build/pdf.min.mjs (served here as pdfjs-6.4.299/pdf.min.mjs).

The hashes below are published by the same server they describe, so they're useful for comparing files, not independent proof of where the files came from. Our CI checks selected invariants on every change: the security policy directives, a list of files allowed in a release, byte-identical pdf.js, and a browser test that a document's text never appears in any network request or message.

Converter file hashes (SHA-256)

Release 09d94111cf6f, built 2026-11-04T13:48:10.043Z. Fonts, character maps and colour profiles are listed in SHA256SUMS.txt.

Report a problem

Found a security issue? Email [email protected]. See also security.txt.