Security

What runs on your device

Merge PDF, Split PDF, Rotate PDF, Delete PDF Pages, Extract PDF Pages, JPG to PDF, PDF to JPG, Watermark, Add Page Numbers, Protect and Unlock run in the browser on your device. File bytes are read by application code delivered to the browser and are not sent to an ArchwayPDF processing API.

PDF passwords and visible labels

Protect creates a password-to-open PDF using AES-256 encryption. Unlock uses a valid password to create an unencrypted copy; it does not guess or recover passwords. Certificate-based encryption is not supported. Keep passwords and unencrypted originals in a safe place: ArchwayPDF has no recovery copy.

A recipient who can open a PDF can read and potentially redistribute its contents. Permission flags are not strong DRM, and a visible watermark is not encryption or redaction. Modifying a digitally signed PDF may invalidate its signature. Check the result before sharing and retain the original when a signature matters.

Memory, previews, and downloads

Processing uses browser memory. Temporary object URLs may be used to preview selected images and make generated files downloadable; the application revokes them when they are no longer needed. Your browser and operating system control the final download location and may keep their own download history.

Large or complex documents can exceed a device’s available memory. Limits, progress, cancellation, and controlled errors reduce this risk, but users should keep an original copy and close other memory-intensive tabs when processing large files.

Service and supply-chain security

Production delivery is designed around HTTPS, a static application artifact, pinned dependencies, restrictive browser headers, and a minimal collection of data. Security is an ongoing process rather than an absolute guarantee. The U.S. Federal Trade Commission’s guidance similarly emphasizes collecting only needed data, protecting what is retained, and disposing of it when no longer required.

Future server-side tools

If ArchwayPDF later adds a tool that uploads or processes files on a server, that tool will be clearly labeled before file selection. Its storage, retention, deletion, access, and subprocessors will be documented separately; the browser-only statement on this page will not be silently generalized to it.

Report a vulnerability

Report suspected vulnerabilities to security@archwaypdf.com. Do not include another person’s documents, personal data, passwords, or destructive proof-of-concept activity.