Security at Local2PDF

Browser-Local Processing

All image conversion and PDF generation runs entirely in your browser using client-side JavaScript. Your images are never uploaded to any server. No one else can see or access your files.

Network Requests

The only network requests made after the initial page load are for analytics (if enabled) and advertising (if displayed). Your images, PDF contents, and filenames are never included in any outgoing request.

Third-Party Dependencies

We use jsPDF and PDF-lib for PDF generation. Both are well-established open-source libraries with active maintainers. We pin dependency versions and review updates before deploying.

Analytics

We may use privacy-safe analytics to understand feature usage and improve the tool. Analytics never receive your filenames, image contents, generated PDF contents, or any personally identifying information from your files.

Advertising

This site may display advertisements. Ads are clearly labeled and are never placed inside the converter tool or near action buttons. Advertising partners may use cookies for frequency capping and measurement, subject to your consent where required.

Local Storage

We store your preferences (page size, quality settings, and similar configuration) in your browser's local storage. No file data, personal information, or sensitive values are persisted.

Memory Cleanup

All image bitmap data, rendered canvases, and generated PDF blobs are released from memory when you close or refresh the page. We use object URL revocation and structured cleanup to prevent memory leaks.

Password-Protected Files

If you use password protection features, the password is applied client-side to the generated PDF. Your password is never transmitted over the network or persisted to any storage.

Security Headers

Our hosting provider applies standard security headers including Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and strict Transport Security (HSTS).

Vulnerability Disclosure

If you discover a security vulnerability, please email [email protected]. We aim to acknowledge reports within 48 hours and provide a timeline for resolution. We appreciate responsible disclosure and will credit researchers who report valid issues.