How we handle your files

Most QuickCatPDF tools never upload your files: they run inside your browser, on your own phone or computer. A smaller group of tools, mainly office documents and e-books, needs software that can't run in a browser, so those files are converted on our own server and deleted automatically. Every tool page tells you which kind it is, just above the tool.

The full lists and the details are below.

Tools that run in your browser

All image to PDF tools, all PDF to image tools, the PDF to Word, Excel, CSV, Text, Markdown, HTML, JSON, XML, PowerPoint, EPUB, MOBI, AZW3 and DXF tools, Image to Searchable PDF, DXF to PDF and the PDF Converter (including OCR for scanned pages) and all PDF tools (merge, rotate, remove and organize pages, watermark, rename, viewer and live page) run entirely in your browser. The files are read by the page on your device and the result is created there. Nothing is uploaded. You can check this yourself: load a tool, switch off your internet connection, and convert a file.

JPG photos often contain the location where they were taken. Our tools remove this location data before adding photos to a PDF.

Tools that use our server

Office documents (Word, Excel, PowerPoint, Publisher, OpenOffice and Apple iWork files) need full office software to lay out correctly, which can't run in a browser. E-books, comics and DjVu files (the eBook to PDF tools), and text, Markdown, CSV and HTML files when you click Download PDF, need a page-layout engine or decoders that can't save a PDF file from a browser either. PDF to PDF/A, EPS to PDF and DWG to PDF need specialist programs too. These tools send your file to our own server, where LibreOffice, a headless Chromium browser, bsdtar and DjVuLibre for e-books, Ghostscript for PDF/A and EPS, or LibreDWG for DWG drawings converts it. They:

• send files over an encrypted HTTPS connection;
• convert each file in a fresh process, inside a sandboxed service that has no internet access;
• never run macros or scripts in your documents and books, and never load anything they link to; PostScript in EPS files runs in Ghostscript's safe mode, which can't read or write other files;
• refuse books protected with DRM;
• delete the original as soon as the conversion ends, delete the PDF as soon as your browser has downloaded it, and delete anything left over (for example if you close the tab) within 1 hour;
• never log file names or contents, and are never opened by people.

Two options run on your device instead. Older Apple Pages, Numbers and Keynote files contain a ready-made PDF preview, which the page takes out in your browser without uploading the file. For a single EPUB, MOBI, AZW3, FB2 or PDB book, or a text, Markdown, CSV or HTML file, Save as PDF on this device lays it out in your browser and opens its print window, so the file isn't uploaded. The Convert Any File tool makes image PDFs in your browser and keeps PDFs on your device too. DWG to PDF only reads the drawing on the server; the PDF itself is drawn in your browser, and DXF files aren't uploaded at all. PDF to Audio reads the PDF in your browser: Make MP3 sends only the text to the server, where eSpeak NG and FFmpeg turn it into speech, and Listen in browser sends nothing. In the Batch PDF Converter and Document Converter, PDFs are converted in your browser and only office documents and e-books in the batch are sent to the server.

Webpage to PDF

Webpage to PDF has to load pages from the internet, so it runs in a separate service on our server. That service can reach public websites only: every address a page asks for, including redirects, is checked and refused if it points to a private network, the server itself or a cloud-internal address, and the operating system blocks those destinations as well. The addresses you convert are never written to our logs, and each PDF is deleted as soon as it's downloaded.

Report a security problem

If you think you've found a security weakness in QuickCatPDF, email the details to [email protected]. Please describe what you found and how to see it, but don't test it on other people's files and don't overload the service. We look into every report and fix confirmed problems as quickly as we can. For anything else, see our contact page.

Open-source software

Our tools are built with these open-source projects. Their licence texts are published with the site.