DEV Community

ahmed isam
ahmed isam

Posted on • Originally published at pdfmergenext.shop

PDFMergeNext Privacy Design: Why Files Never Leave Your Browser

#privacy #pdf #security #webdev

--
title: "PDFMergeNext Privacy Design: Why Files Never Leave Your Browser"
description: "A privacy design deep dive: no upload endpoint, no server storage, no merge history. How local PDF processing works architecturally, what gets logged, and the honest security boundaries."
tags: [privacy, pdf, security, webdev]

canonical_url: https://pdfmergenext.shop/blog/pdfmergenext-privacy-design

Most "secure PDF tools" ask you to trust a server. PDFMergeNext removes the server from the equation entirely, and this post explains how, architecturally.

The core principle: files never leave the device

The first decision was where to run the processing. Online tools upload PDFs to a server, which means file content passes through third-party networks and disks, even if the vendor never reads it. PDFMergeNext runs the whole pipeline in the browser: reading, parsing, merging, and writing all happen in your device's memory.

Concretely, that means:

  • No upload endpoint. There is no code path that sends file content to a server.
  • No server storage. No file storage, no merge history, no account system tied to files.
  • No third-party processing. No cloud PDF APIs; everything is local.

How the merge pipeline works

Selected PDFs are read into memory via the browser File API. PDF.js parses page structure and renders previews. Sorting, deletion and merging operate on in-memory page objects. The result is generated as a Blob and downloaded via URL.createObjectURL. No network request carries your file content. The only external calls are loading the tool's own static assets, unrelated to your files.

This is also why it works offline: the tool is a static site, and once cached it runs with no backend at all.

The honest logging policy

The site runs basic anonymous access statistics: page views, sources, device types. Deliberately not recorded: file names, file content, merge history, file hashes, or any association between IPs and files. Task memory is released when the job finishes.

Security boundaries, stated plainly

Encrypted PDFs require your password, with decryption happening locally. And local processing depends on the browser sandbox, so a compromised machine or malicious extension could in principle read page content. Sensitive work belongs in a clean browser environment.

Full white paper with the comparison table: https://pdfmergenext.shop/blog/pdfmergenext-privacy-design

中文操作指引：

Top comments (0)