Don’t take our word. Unplug us.

This is the check that needs no trust and no tools. A page cannot send a file anywhere while the device has no network.

1. Open a tool, for example Compress to a size, and let the page finish loading. The first visit downloads the engine; after that the browser keeps it.
2. Turn on airplane mode, or switch off Wi-Fi and unplug any cable.
3. Add your file and run the tool. Save the result.
4. If the result appears and saves, the work happened on your device. An upload-based site fails at this step.

For a stricter test, close the tab before you reconnect. A page could, in principle, hold data and send it later; a closed tab cannot.

Every desktop browser can show you each request a page makes, with its destination and size.

1. Open the tool page, then open developer tools: F12 on Windows and Linux, Cmd+Option+I on a Mac. Select the Network tab.
2. Tick “Preserve log” so the list survives navigation, then clear it.
3. Add your file and run the tool. Watch the list as it works.
4. Read what appeared after your file was added. On pdfnex every request goes to pdfnex.com: engine files the first time a tool loads (WebAssembly, workers, OCR models) and small analytics beacons to /api/e that name the page, the tool and the outcome. Click any request and open its Payload tab to see exactly what it carried.

A request to another domain, or one whose size is close to your file’s size, is what to look for on any site. The guide How browser-based PDF tools work explains each check in more depth.

Our server sends this Content-Security-Policy on every page. It is printed here from the same constant the server uses, so the two cannot drift apart. connect-src 'self' means scripts on the page may talk only to pdfnex.com: no analytics vendor, no CDN, no API elsewhere. Compare it with the response headers of the first request in DevTools.

default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'

The policy restricts where the page’s scripts can connect. It does not limit what our own server receives, which is why it belongs together with the two checks above.

Every file the tools run (WebAssembly, workers, OCR models) is served from our origin and listed in a published manifest with its SHA-256. The bundle hash below is one SHA-256 over all of them; if any engine file changes, it changes.

Bundle hash

1a8a895ead52f3dcbba4c5c177271c13365c58ae4339bba7a16be843e8bb1c93

Built by

scripts/engine-copy.mjs

Files

215 · 48.7 MB

Manifest

/engine/manifest.json

To compare a file: save it from DevTools → Network while a tool loads, then run shasum -a 256 file (macOS, Linux) or certutil -hashfile file SHA256 (Windows).

We plan to publish the engine code as open source. It is not public yet, so there is no link here. The three checks above work without it.