Why PDFsansar has no server

The upload nobody questions

You have done this before. A bank statement, a signed contract, a scan of your passport. You drag it onto a website, watch a progress bar, and download whatever comes back.

In that moment the file left your laptop and landed on a machine you cannot see, owned by people you have never met, under a retention policy you did not read. Most of those sites are run by decent people and delete the file an hour later. That is not really the point. The point is that you had to trust them and had no way to check.

So we removed the server

Browsers quietly got very good. The one you are reading this in can open a PDF, pull it apart, rebuild it and hand you the result, without asking anything of the internet. Every tool on this site is built on that.

When you drop a file into Merge PDF or PDF to JPG, the work happens in the tab that is already open. Your file is read from your disk, changed in your own memory, and written back to your downloads folder. It is never sent to us, because we did not build anywhere to send it.

There is no upload endpoint on this site. Not a private one, not a temporary one. The thing that would carry your file away does not exist.

How to check we mean it

A privacy promise you cannot verify is just marketing. This one takes about ten seconds to test, and we would rather you did.

• Open any tool, then load it and turn off your wi-fi. Now drop in a file. It still works, because nothing needs the network once the page is open.
• Or open your browser's developer tools, switch to the Network tab, and use a tool normally. You will see the page load. You will not see your file go anywhere.

The bug behind the decision

This project started from an open-source template that did the work the usual way, on a server. That code took the file you uploaded and passed its name straight to a command-line PDF program. A filename with the right characters in it could run commands on that server.

It is an old, well-known class of bug, and it was sitting in software people were running to process other people's documents. We could have patched that one line. We deleted the server instead.

A machine that never receives your file cannot leak it, cannot be breached for it, and cannot be compelled to hand it over. That is a much better guarantee than a promise to be careful.

How this stays free

Running PDFsansar costs very little, because your device does the actual work. We pay for a domain and some static hosting. That is close to the whole bill.

Advertising covers it. Today that is one thing in one place: the search page shows results from Google underneath our own, and those carry ads. Ads see the page you are on, the same as on any other site. They do not see your files, for the same reason we do not: the files never leave your device. If that ever changes, this page changes first, and so does the privacy policy.

There is no paid tier, no account, and no email capture. Nothing here is a funnel to something else.

Who runs this

PDFsansar is built and run by ICT For Media, a small independent team working on the open web. No investors, no growth targets, no roadmap set by anyone but us.

If a tool gets something wrong, if a file will not open, or if there is a tool you keep wishing existed, we want to hear it. Tell us. We read everything.

If you would rather see the mechanics than the manifesto, how it works walks through what happens between the drop zone and your downloads folder.