Privacy

Privacy Policy — PDF Password Remover

This page explains what happens to your PDF, its password and other information when you use this site. It describes how the site works today.

No account neededUnlocked in your browserHTTPS only

In short

  • • The PDF Password Remover on this website unlocks PDFs in your browser, on your device.
  • • The public tool code has no PDF-upload fallback. Browser network behavior has not yet been independently verified by interception tests.
  • • The separate developer API (see the API docs) does process PDFs on our server — described below.
  • • Google Fonts are loaded externally. AdSense is disabled in the checked-in environment configuration; the deployed configuration has not been checked.

How browser-based PDF processing works

  1. You choose files and an operation. The PDF Tools Studio reads and edits supported unencrypted PDFs in your browser; password removal uses the current password you provide to the local unlocker.
  2. The first time, your browser downloads the PDF engine (qpdf, compiled to WebAssembly) from this website. This download contains no information about your file.
  3. The unlock engine runs in a background worker. PDF Tools Studio uses pdf-lib for PDF edits and PDF.js (WebAssembly-enabled browser worker) for JPG rendering and selectable-text extraction. The PDF.js worker is served as a static asset by this website. The inspected public-tool code has no explicit document-upload request or server-processing fallback. Automated browser network interception has not yet verified this behavior.
  4. Generated files are offered as browser downloads. Temporary download object URLs are revoked after a download is initiated. Unused split-download links are cleaned up when the selected file changes or you leave the tool. The unlocker clears the password field after successful processing.

What our website tool does not do

  • The inspected public-tool code contains no explicit upload of the PDF or unlocked copy.
  • The unlock flow passes the password to a same-tab worker; automated network interception has not been run.
  • No document upload fallback is present in the inspected public-tool code.
  • It does not require an account.
  • It does not use analytics tools.

If the engine can’t unlock a file, the UI reports an error; there is no upload fallback in the inspected source. This claim still needs an automated browser request-interception test.

Developer API (server-side processing)

The HMAC-authenticated API described on the API docs page works differently: PDFs sent to the API are uploaded to our processing server over HTTPS. The server opens the PDF with the supplied password in memory, in a separate worker process, and returns an unprotected copy. Our code does not save the PDF to disk; like most web servers, the web framework may temporarily buffer a large upload in a temporary file while the request is being handled.

The API does not store your password or write the PDF, its filename or the password to its logs. If an unexpected error occurs, the server records a technical error message that does not include the password or filename.

Server and hosting logs

This website is hosted by Vercel and the developer API server by Render. Like most web services, their request logs can record technical information such as your IP address, browser type, the address requested and the time. Those logs are kept under each provider’s own retention policies.

Stored in your browser

  • Your light/dark theme choice (localStorage).
  • On the API docs page, API keys you create are listed in your browser’s localStorage; the API secret is shown once and is not persisted. Avoid creating keys on shared computers.

Developer API keys

When you create an API key, our server stores the key, an encrypted copy of its secret, a SHA-256 hash of the secret, the label you chose, when it was created, whether it is active and a daily count of API calls (used for the daily limit). The server log records the label and the first four characters of the key when a key is created, and the first four characters of the key when it is deleted. These are key-management records only — they never contain PDFs, filenames or passwords. Deleting a key on the API docs page deactivates it; the inactive key record is kept. PDFs sent through the API are uploaded to the API server for processing, independently of the browser-only website tools described above.

Third-party services

These services receive technical information (such as your IP address and browser details) when your browser loads them. The inspected application source does not attach PDF contents, names, or passwords to these requests; network interception has not independently verified this. Their code runs on the page under their own privacy practices.

  • Google Fonts — fonts and icons are loaded from Google’s servers. See the Google Privacy Policy.
  • Google AdSense — an existing publisher configuration can load the advertising script when enabled. The checked-in environment flags currently disable it; the live deployment setting has not been verified. If enabled, Google may receive standard network, browser, and advertising data, but document contents, names, passwords, and extracted text must not be sent.
    • Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
    • Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
    • You can opt out of personalised advertising in Google Ads Settings, or opt out of some third-party vendors’ cookies at aboutads.info.
    • Learn more about how Google uses information from sites that use its services.

Privacy FAQ

Is my PDF processed in my browser?

The website unlocker and PDF Tools Studio processing code run in your browser. Source inspection found no document-upload fallback, but browser network interception has not been run. The separate developer API processes PDFs on its server.

Do you keep a copy of my PDF?

The public tool code does not deliberately persist a selected document to application storage. Browser-level network behavior has not been independently verified; your browser or operating system may retain downloads, cache, or crash artifacts.

Do you store my password?

The unlock code passes the password to a worker in the same tab and clears the input after successful processing. No upload fallback is present in the inspected code; network interception has not independently verified requests.

How can I contact you?

Email saikrishnachaitanya61@gmail.com with any privacy question or request.

See also our Terms of Use. This policy may change as the site changes; the date below shows the latest update.

Last updated: 2026-10-11