Is it safe to edit a PDF online?
It depends on one thing: whether the site uploads your file. Most do. docubend does not — fourteen of its sixteen PDF tools run entirely in your browser, so your document never reaches a server. Rather than ask you to believe that, this page shows you how to check it yourself.
The short answer
Fourteen of our sixteen tools never send your file anywhere. Merging, splitting, compressing, rotating, reordering, deleting pages, converting to and from Word and JPG, filling a form, editing the text, annotating and signing all run inside the tab you have open, on your own computer. We do not receive the file, so there is nothing for us to store, nothing to leak, and nothing to hand to anybody who asks. That is not a policy we could quietly change — it is where the code runs.
No account, no sign-up wall, no watermark, and nothing kept: close the tab and the session is over.
Don't take our word for it — watch
Before you use any online PDF tool, including this one, press F12 to open your browser's developer tools and click the Network tab. Then do the job. An upload is not subtle: you would see the request, the number of megabytes, and the address it went to. On our browser-side tools you will see the page and its code load, and then nothing further while your document is worked on.
This is the test worth applying to every site you are about to hand a contract, a payslip or a medical form to. It takes ten seconds and it replaces a promise with a fact.
The two that do send it, and why
A browser cannot perform real PDF encryption, so password-protecting a PDF and unlocking one cannot be done in one. Those two send your file to our server. Both pages say so on themselves, before you use them, rather than in a policy you would have to go looking for.
What happens to it: the file travels over an encrypted connection, qpdf applies AES-256 or removes the existing encryption, and the result comes straight back to you. The temporary copy is deleted as soon as the result is returned — in a cleanup step that runs even when the job fails, so there is no path that leaves a file behind. It is never written to a database. The password you type is used and never recorded, not in storage and not in a log.
“Isn’t offline desktop software safer?”
It is the right instinct and it is aimed at the wrong thing. The reason people are told to use an installed application for a sensitive document is that a website normally uploads your file to somebody else’s computer. That is the risk. Installing software is just the usual way of avoiding it.
A browser is a computer program running on your machine. When the editing happens inside it — as it does here for fourteen of the sixteen tools — your file is being processed locally, by software on your own hardware, in exactly the sense a desktop application processes it. The difference is that there is nothing to install, nothing to keep updated, and no installer to trust.
So the honest comparison is not “web versus desktop”. It is uploaded versus not uploaded, and that question has a definite answer for any site you are looking at — including this one — in ten seconds with the Network tab.
Where an offline tool such as PDFgear or PDF24 Creator is genuinely different: it also works with no internet connection at all, and nothing about the page can change under you between visits. If your document is classified, or your policy forbids a browser touching it, that is a real reason and we are not going to argue you out of it. Adobe Acrobat and Foxit are the enterprise answer and they are good products; they are also a licence, an installation and an account.
For the ordinary case — a contract, a payslip, a scanned form, a passport copy — the question worth asking is whether the file leaves your machine. Here it does not.
What we do collect
Our web server keeps ordinary request logs: your IP address, the page, the time and the browser you used. That is how faults and abuse get noticed, and it is what every web server on the internet does.
Because the free tools run on your computer, we would otherwise have no idea whether they worked, so the page sends us a short note about what happened — that a PDF was opened, roughly how big it was, how many pages, which tool was used, whether the download succeeded and the text of any error. It never sends the name of your file, and it never sends any part of its contents. That is a hard rule rather than a setting: the file is not there to send.
If you decide to keep documents here
An account is the one case where we do hold your work, because that is what the account is for — documents you can come back to, with their history. It is opt-in per document: nothing is stored unless you save it.
What protects it:
- Encrypted in transit, always. Every request is HTTPS, plain http is redirected to it, and we send HSTS with a one-year lifetime and includeSubDomains — after one visit your browser will not talk to us any other way.
- Encrypted at rest, with the key kept elsewhere. Your documents, every earlier version of them, their names, your comments and the page images are stored sealed with AES-256-GCM. The key is not in the same place as the data and the account that owns the database cannot read it — so a database file copied off the machine, a backup that goes astray, or a disk decommissioned without wiping is ciphertext and nothing else.
- Your own account, and nobody else's. Documents are reachable only by you and by the people you explicitly share them with, checked on every request. Passwords are stored as salted PBKDF2-SHA256 hashes; we could not tell you your own password if you asked.
- A dedicated server, and a dedicated system account. Your files and the database are readable only by the application itself, not by anything else on the machine.
- Deletion that means it. Deleted documents wait thirty days in a bin so a mistake costs a click, then they are gone. Emptying the bin is immediate. Closing your account takes everything with it, and you can export your documents first.
- Backed up nightly, and the restore is tested — because a backup nobody has ever restored is a hope, not a backup.
We do not sell data, we do not use your documents to train anything, and we do not look at them — the terms say so in those words, and the privacy notice goes through it line by line.
Who is actually behind this
Brevard Creek Labs, LLC, a North Carolina limited liability company, in the United States. Everyone who works on docubend — the code, the servers, the support you would get if you wrote in — is a US citizen working in the United States. No part of it is outsourced or offshored, and no third party has access to your documents.
Still not sure? Talk to a person.
If your document is sensitive enough that a web page is not going to settle it, write to us and say so — we will get on a call or a video conference and walk you through exactly where your file goes, including showing you the network trace live if that is what would help.
That offer is not a sales call. Somebody who is careful about where their documents go has asked the right question, and it is a question we would rather answer properly once than have somebody guess at.
Questions
Do you see my file?
For fourteen of the sixteen tools, no — not the file, not its name, not one byte of it. The work runs in your browser, so there is nothing to send us. The two exceptions are password-protecting and unlocking a PDF, which no browser can do, and both of those pages say so on themselves before you use them.
How can I check that, rather than believing you?
Open your browser's developer tools before you start, go to the Network tab, and use the tool. An upload is not a subtle thing: you would see the request, its size and where it went. It is worth doing on any site you are about to hand a document to, including this one.
What happens on the two tools that do send the file?
It travels over TLS, qpdf encrypts or decrypts it on our server, the result comes straight back to you, and the temporary copy is deleted as soon as it is returned — in a finally block, so it happens even when the job fails. The password you type is used and never written down: not to a database, not to a log.
If I make an account, what do you keep?
Only what you save. A document you make or open in the workspace is stored so you can come back to it, along with its version history. You can delete any of it; deletions wait in a bin for thirty days so a mistake is a click to undo, and after that they are gone. Closing the account takes the lot.
Is my connection encrypted?
Yes. Everything is HTTPS, http requests are redirected to it, and the site sends HSTS with a one-year lifetime and includeSubDomains — so after your first visit your browser refuses to talk to us any other way. Passwords are stored as salted PBKDF2-SHA256 hashes, never as text.
Is it encrypted? Can you read my documents?
Encrypted both ways: HTTPS in transit, and AES-256-GCM on everything we store, with the key held outside the data it protects. What that guards against is a copy of the database or a backup leaving the machine — those are ciphertext. What it does not guard against is us: the server decrypts a document in order to show it to you, so we could read one. We do not, the terms say so in those words, and we would rather tell you that plainly than use a phrase like 'zero-knowledge' that would not be true here.
Is it safer to use offline desktop software instead?
The reason that advice exists is that most websites upload your file. Ours does not: for fourteen of the sixteen tools the editing runs inside your browser, which is software on your own machine, so your document is processed locally in the same sense a desktop application processes it — with nothing to install and no installer to trust. An offline tool like PDFgear or PDF24 does have one real advantage: it works with no internet connection at all. If your policy forbids a browser touching a document, that is a good reason. For an ordinary contract or form, the question that matters is whether the file leaves your machine, and here it does not.
Can I use this for confidential or financial documents?
For the fourteen browser-side tools there is no upload, so there is no copy of your document anywhere but your own computer — which is the property that makes a document safe to work on. Do not use password-protect or unlock for something you cannot send over the internet at all: those two do reach our server, and they say so on their own pages. And if a rule where you work says a browser may not touch a particular file, follow the rule; we would rather tell you that than have your compliance team find out from us.
Who works on this, and where are they?
Brevard Creek Labs, LLC, in North Carolina. Everyone who touches the code or the servers is a US citizen working in the United States. No part of it is outsourced or offshored, and no third party has access to your documents.
I have a question this page does not answer.
Ask, and if it is easier to talk it through, we will get on a call or a video conference with you. That offer is real and it is not a sales call — somebody who is careful about where their documents go is exactly the customer we want.