Security and file handling

Effective date: July 14, 2026. PDFToolkit separates browser-local tools, server-processed tools, validation, temporary files, and direct browser downloads.

• Browser processing

  Merge PDF, Split PDF, PDF to Text, Extract Images from PDF, Remove PDF Annotations, Rotate PDF, Delete PDF Pages, Extract PDF Pages, Organize PDF, Number Pages, Crop PDF, Watermark PDF, PDF Metadata Cleaner process files in the browser. File contents are not sent to the PDFToolkit server for those tools.

• Page organization

  Organize PDF pages are reordered, rotated, copied, or removed in the browser. The selected PDF is not uploaded to PDFToolkit for this workflow.

• Crop is not redaction

  Crop PDF changes the visible page area. It is not a secure redaction method and should not be used to hide sensitive information.

• Watermarks are labels

  Text watermarks are added in the browser. A watermark is a visual label and does not provide encryption or access control.

• Metadata cleaning limits

  Supported PDF document properties are read and updated locally. Metadata cleaning does not automatically remove visible text, annotations, attachments, hidden layers, or redacted content.

• Text extraction is not OCR

  PDF to Text extracts selectable text that already exists in the PDF. It does not recognize text from scanned pages or photos.

• Embedded image extraction

  Extract Images from PDF looks for supported embedded image resources. It does not render whole pages, and unsupported masks, vector artwork, or unusual encodings may be skipped.

• Annotation removal limits

  Remove PDF Annotations removes supported annotation objects such as comments, highlights, ink, stamps, shapes, and links. It is not redaction or complete privacy cleanup.

• Server processing

  Compress PDF, JPG to PDF, PDF to JPG, Protect PDF send the selected file to the server for the requested task and return the result directly to the browser.

• Upload validation

  Server uploads are validated by size, extension, MIME type, and file-signature checks where the route supports that format.

• Processing isolation

  The live tool API returns the processed file directly. PDFToolkit does not create publicly browsable result pages for server processing tasks.

• Temporary storage

  Temporary server files are removed when the processing request finishes. Cleanup is also attempted when processing fails. Browser download blobs remain only in the current browser session.

• Logging

  The public app does not send file contents, PDF text, passwords, or generated download URLs to analytics.

• Password handling

  Password fields are used only for Protect PDF requests in the current live tool set and are not displayed back to the user.

• Vulnerability reporting

  Send the affected URL, steps to reproduce, and impact to support@pdftoolkit.top.