Open the editor

Security

What leaves your device

Editing happens in your browser: your PDF stays on your device. Here is every case where something is sent to our server, tool by tool, and what happens to it.

The short version

  • Editing, signing, filling in, redacting, merging, splitting, compressing and adding a password run in your browser. The file is not uploaded.
  • A scanned page's picture is sent to be read only after the editor asks and you agree.
  • An office file is uploaded to be converted, and deleted as soon as the conversion ends.
  • Asking others to sign is the exception you choose: the PDF is encrypted in your browser and our server keeps only the encrypted copy. By default its key stays in the links you send; if you let GenPDF email the links, our server holds the key until the request ends. The copy is deleted when the request ends or 30 days after everyone has signed.
  • If your browser cannot run the editing engine, the PDF goes to our server only if you agree.
  • Error reports and visit counts never contain a document, its text, its file name or anything you typed.
  • In the Android app the recent files are copies kept on your phone only, and GenPDF loads no Google Analytics, no Microsoft Clarity and no ads there and asks no cookie question.
  • Google Analytics counts visits. Where the law asks for your consent (such as in the European Union and the United Kingdom), it sets no cookie until you accept; elsewhere it sets its cookies from your first visit. Microsoft Clarity, which shows us clicks and scrolling on the public pages, follows the same rule: it stays off until you accept where the law asks for your consent, and starts from your first visit elsewhere. It never runs in the editor, signing or account pages. You can say no at any time with "Cookie settings", and a browser’s Global Privacy Control signal counts as a no.
  • Google AdSense shows ads on the public home pages, under the same rule: where the law asks for your consent, its code is not loaded until you accept. Google and its partners may use advertising cookies to personalise them, and you can opt out in Google’s Ads Settings (myadcenter.google.com). Ads never appear in the editor, on a document, or in the signing and account pages, and they never receive a document, its text or its file name.

Tool by tool

  • Edit text, add text, find and replace, sign, fill in forms, highlight, stamp, add a watermark or page numbers, redact, flatten

    Sent to our server
    Nothing.
    What happens to it
    The PDF engine (PDFium, compiled to WebAssembly) runs in your browser and works on the file there.

  • Merge, split, compress, organise, rotate or crop pages; PDF to Word; PDF to pictures; pictures to PDF

    Sent to our server
    Nothing.
    What happens to it
    Done in your browser, on your device.

  • Save a copy for sharing

    Sent to our server
    Nothing.
    What happens to it
    Done in your browser. The copy is flattened and its scripts, launch and submit actions, media and embedded files are removed. A normal download is not cleaned: it keeps whatever the original PDF carried.

  • Add or remove a password (Protect, Unlock)

    Sent to our server
    Neither the file nor the password.
    What happens to it
    The password is added or removed in your browser. When you add one, our server is told only that the tool was used, so that it can be counted against your plan's daily allowance.

  • Read a scanned page (OCR)

    Sent to our server
    A picture of each scanned page you choose to read, a few pages at a time.
    What happens to it
    The editor asks before the first page is sent, once per document, unless you chose "Don't ask again on this device". An OCR program on our server reads the picture and returns the text; the picture is not saved. Pages read are counted against your daily allowance.

  • Convert a Word, Excel, PowerPoint or OpenDocument file to PDF

    Sent to our server
    The file.
    What happens to it
    It is written to a private temporary folder on our server and converted with LibreOffice. The folder is deleted when the conversion ends, whether it worked or not. Files converted are counted against your daily allowance.

  • Translate, summarise or ask about a document (AI), where this site has AI switched on

    Sent to our server
    In the AI panel, the text of the pages you choose, as plain text: never the PDF file, its pictures or its name. Only after you choose "Send the text" for that document.
    What happens to it
    Our server passes the text to Anthropic, which runs the AI model and handles it on our behalf; under Anthropic's API terms it is not used to train its models. GenPDF stores neither the text nor the answers, and its log keeps only counts. A translation is written back into the document in your browser. The AI panel is not shown on a site where AI is switched off. Credits used are counted against your daily allowance.

  • Read a scanned page with AI (Text panel), on the paid plans, where this site has AI switched on

    Sent to our server
    A picture of the one page you choose, and the lines the scan reader found on it (their words and where they are on the page). Only after you choose "Send the picture and read", each time. Never the PDF file or its name.
    What happens to it
    Our server passes the picture and the lines to Anthropic, which runs the AI model and handles them on our behalf; under Anthropic's API terms they are not used to train its models. The model answers with the corrected words of the lines it changes, and the editor puts them back; you can undo it. GenPDF stores neither the picture nor the answer, and its log keeps only counts. Credits used are counted against your daily allowance.

  • Edit in a browser that cannot run the editing engine

    Sent to our server
    The PDF, only if you choose "Send to our server".
    What happens to it
    The same engine edits it in memory on our server, under a time limit, and nothing is stored. Your choice lasts for that tab, and the top bar says "Editing on our server" while it is in use.

  • Type in a font the PDF does not contain

    Sent to our server
    The font's name and style, and each distinct character needed (not your sentence).
    What happens to it
    Our server sends back that font reduced to those characters. It may download the font file from Google Fonts by its name; no text is sent there.

  • Report a problem, on the paid plans

    Sent to our server
    The sentence you write, and a few facts about the editor and the file: the GenPDF version, your browser, the number of pages, the file's size and kind, the names of its fonts, the software named in it and the last error the page met. Never its words, title, author or file name. The PDF itself only if you tick "Also send GenPDF this PDF so the problem can be fixed".
    What happens to it
    It is stored on our server, and only GenPDF's administrator can open it. A shared PDF is kept for 30 days at most and is deleted at once when the problem is closed as fixed or not to be fixed; the report itself is deleted a year after its last change, closed or not. To find the cause, the administrator may have an AI assistant (Claude, by Anthropic) read the PDF and your sentence on a temporary GitHub machine that is wiped afterwards. GenPDF's log keeps only counts.

  • Keep working after a crash or a closed tab

    Sent to our server
    Nothing.
    What happens to it
    The open document is kept in your browser's own storage, on your device, so that the editor can offer it back for 7 days. It is forgotten when you close the PDF, open another or choose Forget.

  • Recent files in the Android app

    Sent to our server
    Nothing.
    What happens to it
    The app keeps a copy of each PDF you open, the ten most recent and at most 150 MB, in its own storage on your phone, so that Home and Files can open it again. The copies never leave the phone and are not part of your account. Remove one in Files, or all of them in Account, Recent files. They are kept in the browser storage the app uses for genpdf.com, so uninstalling the app does not necessarily remove them: to be sure, clear them in Account or clear genpdf.com’s data in Android’s settings.

  • Request signatures from other people

    Sent to our server
    The PDF, encrypted in your browser. Also the title, your message and the signers' email addresses. By default the key is not sent; only if you tick “Let GenPDF email the links” is it sent, once, when you make the request.
    What happens to it
    Our server stores the encrypted copy and those details and keeps an audit trail: times, a keyed hash of each address, the browser's name and the fingerprints of each version. By default it emails the signers a notice that never holds the key (you send each signer their link), and it cannot read the document. If you let GenPDF email the links, our server instead holds the key, sealed with a secret kept on the server, until the request ends (signed, declined, withdrawn or expired), and then deletes it; it uses the key to put each signer's own link in their emails, which also pass through email providers, and once, when the document arrives, to check that the key opens it (nothing decrypted is kept). While it holds the key, GenPDF could technically open the document; the audit trail records which way the links were sent and when the key was deleted. Everything else is deleted 30 days after the request ends (a request that is withdrawn, declined or expires loses the encrypted copy at once). Requests are counted against your plan's monthly allowance.

  • Sign in, buy a plan

    Sent to our server
    Your email and password, or your Google sign-in; for a purchase, the payment details go to Paddle.
    What happens to it
    Paddle is the merchant of record; we never see or store your card details. The Privacy Policy lists what we keep about an account, and for how long.

  • Download a file you made, on the free plan

    Sent to our server
    Which kind of download it is (an edited PDF, a signed PDF, a Word export or another tool's result), a random identifier for that download and, for Word, its number of pages. Never the document, its name or its text.
    What happens to it
    Counted against the day's allowance of your account or, without one, of a random visitor cookie and a keyed hash of your internet address (never the address itself). The counts are deleted after 90 days.

  • Visit a page, open or download a file

    Sent to our server
    A count, without cookies: the step's name, the page's address without its query, the page's language, your country (for a visit's first page and a few main steps such as opening a file or a download: worked out on our server from your internet address, of which nothing is kept but the country), the site you came from (on a visit's first page only, kept in the counts just as a broad group such as search or social, never the site itself) and our own short labels such as a tool's name. It is kept as a number per day, for 24 months, with no address, no browser identity and nothing that identifies you. While the page is open, it also tells our server, every 30 seconds and when you leave it, how many seconds it has been visible and which page it is on, under a random key kept only in the page's memory (nothing is stored on your device); the server forgets the key when the visit ends. For each visit it keeps one line for 90 days: the minute it began, the country, the broad group it came from and the name of the site that referred you, the first page, the language, the kind of device, the seconds the page was visible and the number of pages, with no address, no browser identity and no key.
    What happens to it
    The counts never hold a document, its text, its file name or anything you typed. If something goes wrong, your browser sends a short error report (what failed, the page's path, the app's version and your browser's name). A program cleans it of web addresses, email addresses, file names and quoted or non-ASCII words as well as it can; the message of a library cannot be proved to hold no word you typed, so we do not promise it. The report is written to our server's log with a reference you can quote (30 days at most) and also joins an anonymous group of the same error (what failed, on which page, in which version and how often; no browser name), kept up to 180 days.

  • Visit statistics with Google Analytics and Microsoft Clarity, after your yes where the law asks for one

    Sent to our server
    Where the law asks for your consent: until you accept, only visits counted without cookies and without an identifier. Elsewhere, and once you accept: the pages you visit (their address without any query), the steps you take with the same short labels, your approximate location, your device and browser, and an identifier kept in Google's cookies. On the public pages, Microsoft Clarity also sees your clicks and scrolling.
    What happens to it
    Google Ireland Limited counts them for us, as our processor. Where the law asks for your consent, Google sets no cookie and Microsoft Clarity is not loaded before you accept. "Cookie settings", in the footer and in the editor's File menu, takes your answer back: the counting stops and the cookies of Google and Clarity are deleted. Never a document, its text, its file name or anything you typed. The Android app loads neither of them and has no cookie notice.

  • Advertising from Google AdSense on the public home pages, after your yes where the law asks for one

    Sent to our server
    Where the law asks for your consent: nothing until you accept, because the advertising code is not loaded. Elsewhere, and once you accept: what your browser sends Google to load an ad (the page's address, your internet address, your browser and device) and Google's advertising cookies. Never a document, its text or its file name, and never on the editor, signing or account pages.
    What happens to it
    Google chooses and serves the ads and decides how it uses the information, under its own privacy policy; it may use cookies to show ads based on your visits to this site and to others. You can opt out of personalised ads at myadcenter.google.com. "Cookie settings" takes your answer back: the ads are hidden and Google's advertising cookies on this site are deleted. The Android app shows no ads.

Where the servers are

Our servers are hosted by OVHcloud (OVH SAS), servers in the European Union.

How the service is protected

  • Pages are served over HTTPS only, and browsers are told to keep using it (HSTS).
  • Passwords are stored only as salted scrypt hashes, and a sign-in is remembered on our side only as a hash of its key.
  • Requests are limited per address, and sign-in and the contact form more tightly.
  • The server counts what it turns away or notices (failed sign-ins, searches for pages this site does not have, requests from other sites) as numbers per day with the country, never an internet address or an account, and deletes them after 180 days.
  • The server copies of the PDF engine, which read files someone else made, run in separate threads with a time limit and a cap on memory, so that one bad file cannot stall the others.
  • The app runs as an unprivileged user in its container, and its dependencies are checked for known vulnerabilities on every change.

The Privacy Policy has the full list of what we keep and who else sees it.

Found a problem?

Please tell us privately through the Contact page, choosing "A security problem". Say what you did, what happened and what you expected, and do not include other people's documents. We aim to answer within three working days.