Security

No uploads, by design

Tools that run in the browser have no server endpoint to send a file to. That is a structural property, not a promise about our conduct — it is visible in the network tab.

No storage, no accounts

There is nothing to sign into, so there is no place a document could be kept. Closing the tab discards everything in memory.

Encryption pages

Protect and Unlock use WebAssembly to run qpdf. That build requires cross-origin isolation, so those two pages are served with stricter headers (COOP and COEP) and load no third-party scripts or ads.

Your password is used to derive the encryption key in the browser. It is not sent, and it is not stored — if you reload the page, it is gone.

Transport

The site is served over HTTPS with HSTS. Static assets come from Cloudflare’s edge; no dynamic code touches your file.

Reporting a problem

If you find a security issue, email hello@sailpdf.com with the details. Please do not post it publicly first.