Free · no account · no limits

Pick a tool

Security and privacy

We'd rather not have your files at all.

So we never ask for them. All 26 tools do the work inside your browser tab, and this page sets out what that means, what it does not cover, and what we are not claiming.

1 · Where your file goes

  1. All 26 tools run entirely in your browser

    Merging, splitting, rotating, page numbers, watermarks, reordering, compressing, signing, text recognition — every tool in the list. The engine is WebAssembly, it runs in a worker inside the tab you are reading this in, and your file is handed to it as memory rather than as an upload. Use one tool, then switch your wifi off and reload: it still works. That is the test, and it is the whole argument.

  2. There is nothing to delete afterwards

    No copy of your document is made anywhere but this tab, so there is no retention window, no deletion job and no "we keep it for sixty minutes". Close the tab and the working copy goes with it. The cost of that is real and worth saying: we cannot get a result back for you, because we never had it.

  3. Nobody here reads them

    No training on your documents, no human review, no analytics on their contents. Nothing about a file — not its name, not its size, not its page count, not a thumbnail — reaches us at all, because nothing about it is ever sent.

2 · What your browser is told to refuse

Every page here arrives with a Content-Security-Policy written by the server, not by the code it is policing. The directive that carries the claim isconnect-src: it governs fetch,XMLHttpRequest, WebSocket, EventSource, sendBeacon and link pings — the whole set of ways a page can move bytes to another machine. Your browser enforces it before a request leaves your computer.

connect-src 'self' https://*.google-analytics.com https://*.analytics.google.com https://in.getclicky.com

Three of those four are the analytics collectors described in §3, and they are named because they are permitted to receive a page address and the usual browser facts once you have said yes. None of them can receive a document: your file is never handed to any request, of any kind, to any origin, including ours. To read the header yourself, open your browser's developer tools, go to the Network tab, reload, select the first request and read the Content-Security-Policy line under Response Headers.

The policy sets no report-uri and no report-to. A violation report is itself an outbound request, fired from the pages we are asking you to check. There is not one, and there will not be.

3 · Analytics, and the banner that asks first

This site loads two analytics services, Google Analytics 4 and Clicky, and it loads neither of them until you press Allow. Before you answer, and permanently if you answer No, no request is made to either company — no script, no pixel, not even a DNS lookup.

If you accept, each sets cookies and receives the address of the page you are on, your IP address and the usual browser details. Neither receives a file. Nothing can: your document is opened, changed and saved inside the tab, and there is no code path on this site that would hand it to an outbound request.

You can change your mind by clearing this site's storage in your browser, which removes the recorded answer and brings the banner back.The full account is on the privacy page.

4 · What this site can't do

Not a list of things we have decided against — a list of things the code on these pages is not able to do.

  • Can'tSend your file anywhere
  • Can'tShow an ad or a paywall
  • Can'tLearn anything about your file — its name, size or contents
  • Can'tKeep a copy after you close this tab
  • Can'tGet anything back for you afterwards

5 · What we are not claiming

The design this site was built from carried SOC 2 Type II and ISO 27001 badges. Both are audited certifications with a named auditor and a report behind them, and Herdo MB holds neither. They are not printed here, and if they are ever earned the certificate will be linked rather than the logo drawn.

Two more things this page will not stretch. Sign PDF is a visual signature — a drawn or typed mark placed on the page. It is not a certified or eIDAS-qualified signature, it carries no audit trail, and it is not cryptographically bound to the document. And Unlock PDF is not a cracker: it removes a password you already know and type in, and that password is used in this tab and sent nowhere.

Finally, the honest edge of the whole claim: loading a page here is still a network request, and our host still sees the request that serves it. What we can do is add nothing on top of that, and until you accept the banner in §3 we have not.

6 · Who is making these claims

  • GDPR — an EU controller
  • Herdo MB, Vilnius, Lithuania
  • No account, ever
  • No cookies before consent

contact@pdfonaplane.com reaches a person. Being told we are wrong about something on this page is genuinely welcome — there is no crash reporter on this site, so an email is the only way we find out.

Last updated 9 August 2026