Security Model

What PDFtoMD.im protects—and what it cannot protect

Architecture

PDFtoMD.im is a static website. PDF parsing, Canvas rendering, layout analysis, Markdown generation, and optional OCR run in the browser. Static OCR assets come from the same origin. There is no document-conversion endpoint.

The production build generates a Content Security Policy from the scripts and styles it actually contains. The policy blocks framing and plugins, restricts scripts and connections to the site plus explicitly allowlisted PageView and Microsoft Clarity endpoints, and permits only the local Blob workers required by PDF.js and OCR. Additional headers deny framing, reduce referrer data, and disable unrelated browser permissions.

Analytics boundary

PageView measures visits, while Microsoft Clarity analyzes rendering and interactions such as clicks, scrolling, and mouse movement. These services are loaded only on production pages. The converter does not send PDF bytes, filenames, extracted text, Markdown output, or table contents to either provider as custom analytics data.

Data lifecycle

1. The user selects a local PDF.
2. The browser reads the file into memory and parses its pages.
3. Temporary Canvas pixels may be created for previews and OCR.
4. Markdown and table data are displayed in the current tab.
5. Clearing or reloading removes in-memory conversion state; explicit downloads remain on the user’s device.

Risks reduced by local conversion

• The complete PDF is not stored in a conversion vendor’s account, queue, or result URL.
• There is no server-side PDF database or password-recovery flow to attack.
• A strict CSP reduces common injection and unauthorized connection paths.
• Low-confidence OCR and table results are surfaced for review rather than hidden.

Risks not eliminated

• A compromised device, browser, extension, operating system, or downloaded file location can still expose content.
• A malicious or malformed PDF may exploit an unknown defect in a browser or parsing dependency.
• Look-alike domains can imitate the interface; verify the address is pdftomd.im.
• Clipboard managers, screen capture, and external apps can retain copied or downloaded Markdown.
• Software supply-chain vulnerabilities remain possible and require dependency updates and rebuilds.

Responsible reporting

A monitored private reporting channel has not yet been published. Do not place confidential document content, credentials, or active exploit material in a public message. This page will list a reporting method only after that channel is configured and monitored.