Skip to content
pdfnina

PDFNina

Security

Last updated October 19, 2026

The safest upload is the one that never happens. That’s why PDFNina runs most tools in your browser. Here is how we protect the rest.

On-device processing

Editing, merging, compressing, redacting, comparing, OCR, protecting and most conversions happen on your device with WebAssembly and JavaScript. The file never leaves your computer.

In transit and at rest

  • All traffic uses HTTPS.
  • Passwords are hashed with scrypt and a unique salt.
  • Session cookies are HTTP-only and same-site; session tokens are stored only as hashes.
  • Signature links and scan sessions use long random tokens, stored only as hashes.

Server-side work

Converted files are deleted right after processing. Web pages for HTML to PDF are fetched by an isolated browser that cannot reach private networks. Requests are checked for their origin, and every endpoint is rate limited.

Redaction that really removes

Redact PDF and the redaction tool in the editor destroy the text, images and drawings under each box instead of covering them, and check the result for leftovers.

Reporting a vulnerability

If you find a security issue, please email us with the details. We’ll reply quickly and credit you if you’d like.

Questions? Write to hello@pdfnina.com.