Security
How FormatLayer protects your PDFs.
Most "free online PDF" services quietly upload your document to a stranger's server, process it there, and hand you back a URL to download. FormatLayer works differently: nothing about your file ever leaves your device. This page explains the security model in enough detail that you can verify it yourself.
Security pillars
No uploads, ever
PDFs are read directly from your device into your browser tab. No FormatLayer server receives or stores the file at any point.
WebAssembly-only processing
Parsing, editing, and re-encoding happen inside your browser using PDF.js and pdf-lib, running as WebAssembly in an isolated sandbox.
Zero-knowledge design
We cannot see the contents of your files because they never reach us. There is no logging, indexing, or content inspection.
No third-party trackers
We do not embed third-party analytics, chat widgets, or ad networks that would receive data while you use a tool.
Passwords stay on your device
When you use Unlock or Protect PDF, the password is used inside the browser to decrypt or encrypt locally. It is never transmitted.
Nothing to breach
We do not maintain a database of user documents, so there is nothing document-related to leak, subpoena, or lose.
The technical model
When you drop a PDF onto any FormatLayer tool, the browser reads the bytes from your disk using the standard File API. Those bytes are handed to a WebAssembly runtime that hosts two open-source libraries: PDF.js renders your document, and pdf-lib performs the edits.
When you click Download, pdf-lib serializes a fresh PDF in memory and hands it back to your browser as a normal file save. At no point is a network request made carrying your file's contents. You can verify this yourself: open your browser's Developer Tools, switch to the Network tab, and use any FormatLayer tool. No upload appears.
Because the processing runtime is your own browser, your PDF is confined by the same sandbox that protects the rest of the web — script isolation per origin, no filesystem access beyond files you explicitly hand to the tool, and no cross-tab access.
Transport and hosting
The FormatLayer application (HTML, JavaScript, WASM, and CSS) is served over HTTPS from a standard content delivery network. TLS 1.2 or higher is enforced on every request. The CDN and hosting layer briefly log the IP address of each HTTP request as part of routine network operations — this never includes the contents of your files, because your files never leave your browser tab.
Static assets are cached with strong integrity headers. The app has no server-side rendering of user content, so common web application vulnerabilities involving user-submitted data on the server (injection, deserialization, SSRF) do not apply to document processing.
Accounts and authentication
Accounts are optional and only exist to save preferences across devices. Authentication uses hashed passwords and standard session tokens over HTTPS. We do not associate any document content with your account because we never receive document content.
What we can't protect against
Local security is your responsibility. FormatLayer cannot protect against malware on your device, keyloggers, screen recorders, browser extensions with document access, or someone with physical access to your machine. If you are handling extremely sensitive documents, use an up-to-date browser on a trusted device, and consider a fresh browser profile with no extensions.
Verify it yourself in three steps
- Open FormatLayer in a new browser tab.
- Press F12 (or right-click → Inspect) and switch to the Network panel. Click "Clear" to empty it.
- Drop a PDF into any tool and export the result. Watch the Network panel — no file upload request will appear. Every byte of your document stayed on your machine.
Report a vulnerability
If you find a security issue in FormatLayer, please email contact.formatlayer@gmail.com with the subject "Security". Please give us a reasonable window to investigate and fix the issue before public disclosure. We acknowledge every report within 48 hours.