Local by default
Files are read, merged, previewed, and downloaded inside your browser. There is no application upload endpoint.
Security overview
Privacy, by design.
Your documents are processed in your browser, not uploaded to an application server.
Dependencies pinned
Every CDN script (pdf-lib, PDF.js, canvas-confetti, and — only on the HTML to PDF page — html2canvas and jsPDF; on the merger, JSZip, docx-preview, html2canvas and fontkit, plus a few open-source fonts, are loaded only when you add a Word file) is loaded from a pinned version with a Subresource Integrity hash. The PDF.js worker is served locally.
Abuse limits
Input size, page count, preview, and concurrent processing limits reduce browser resource exhaustion.
Important boundary
Client-side processing protects against routine server uploads, but it cannot protect files from a compromised browser, extension, device, or trusted script.
A
Data handling
What happens to your files
PDF Pool processes selected files locally and creates the merged result as a temporary browser download. The project does not operate a file-upload API, database, or document storage service.
PDF passwords are used in page memory only while an unlock or merge operation needs them. Do not use the tool on a device or browser you do not trust.
B
Resource controls
Limits that protect the browser
100 MBMaximum input file
250 MBMaximum combined input
500Maximum pages per file
100Preview pages rendered
Unusually complex PDFs can still consume significant CPU or memory. Close other browser tabs if processing slows down.
C
PDF boundaries
The output is not a malware scanner
Most tools (Merge, Split, Organize, Rotate, Crop, Watermark, Page Numbers, JPG to PDF, PDF to JPG) copy or directly edit pages rather than rasterizing them. Existing annotations, links, attachments, or other PDF actions may remain in the downloaded file.
Open downloaded PDFs with a trusted, up-to-date viewer. Do not treat PDF Pool as a document sanitizer or security scanner.
D
Tool-specific notes
A few tools work differently
HTML to PDF loads your uploaded file into a sandboxed, hidden frame with scripting disabled (embedded <script> tags are also stripped as a second layer of defense) before rendering a visual snapshot. External images, fonts, or stylesheets referenced by the file are not fetched, so nothing about your file or your browser is leaked to a third party. The file is never uploaded anywhere.
Word files in the merger are unpacked and laid out entirely in your browser, then each page is rebuilt as a PDF with real, selectable text and full-resolution pictures. Open-source fonts are downloaded from jsDelivr to draw the text; the document itself is never uploaded.
Compress PDF re-renders each page as a compressed image, which shrinks scanned or image-heavy PDFs but makes the resulting text non-selectable and non-searchable. This happens entirely in your browser; nothing is uploaded.
PDF to PDF/A adds PDF/A identification metadata to your file. It is not a certified conformance tool and has not been validated against official PDF/A validators — do not rely on it for legally or archivally mandated compliance.
E
Deployment
How the site is protected
The site is hosted on GitHub Pages and delivered over HTTPS with HSTS. Pages include a Content Security Policy and a restrictive referrer policy.
GitHub Pages does not let this project configure additional response headers such as X-Frame-Options or X-Content-Type-Options. A reverse proxy or security-focused host would be required for those controls.