Security

How it works

When you upload a file to PDF Cloak, it is read into your browser’s memory using the JavaScript File API. The PDF processing library (pdf-lib or PDF.js) runs entirely in your browser tab — there is no server, no API endpoint, and no cloud function. The output file is assembled in memory and handed to you as a download. At no point does any data cross a network boundary.

What we don’t collect

How to verify

You don’t need to trust our word. Verify it yourself in under a minute:

1. 01
   Open any PDF tool on PDF Cloak (e.g., Merge PDFs).
2. 02
   Open your browser's developer tools.

   Chrome: Cmd+Option+I (Mac) or Ctrl+Shift+I (Windows). Firefox: Cmd+Option+I or Ctrl+Shift+I. Safari: Enable from Develop menu.
3. 03
   Click the "Network" tab.

   Check "Preserve log" to keep entries visible across actions.
4. 04
   Upload a PDF and process it.

   Merge two files, split a document, add a watermark — any operation.
5. 05
   Look at the Network tab.

   You will see zero outbound requests carrying your file data. The only requests are for static assets (JS, CSS, fonts) that loaded when the page opened.

Third-party code

All PDF processing is handled by open-source libraries that run in your browser. No proprietary server-side code touches your files.