EditMyPDF LogoEditMyPDF/

Security

Cryptographic Documentation

Security Architecture

Honest, factual documentation of our cryptographic implementations, dependency management, and privacy safeguards.

1. Supported PDF Encryption Standards

EditMyPDF implements PDF document encryption using modern standard algorithms:

  • AES-256 (PDF 2.0 / ISO 32000-2): 256-bit Advanced Encryption Standard using Galois/Counter Mode or CBC with SHA-384 key derivation, verified for maximum security and compatibility with modern viewers.
  • AES-128 (PDF 1.6): Standard 128-bit encryption for legacy workflow compatibility.
  • Native Web Crypto API: Cipher primitives are executed directly via window.crypto.subtle, leveraging your CPU’s native hardware acceleration (AES-NI).

2. Zero Transmission Password Life Cycle

When you set or enter a password on the Protect PDF or Unlock PDF pages:

  • Passwords exist strictly as transient string variables in volatile JavaScript heap memory.
  • Passwords are never logged to console, written to persistent storage, or transmitted across any network interface.
  • Once encryption or decryption finishes, memory references are dereferenced for browser garbage collection.

3. Dependency Auditing & Zero Remote CDNs

To eliminate supply-chain threats and remote tracking vectors:

  • All production dependencies are pinned to specific versions in package.json and locked via package-lock.json.
  • No dynamic external scripts, fonts, or CDN bundles are loaded at runtime.
  • Mozilla’s PDF.js worker script (pdf.worker.min.mjs) is bundled locally on the application origin.

4. Known Limitations & Security Boundaries

We believe in complete honesty regarding technical limits:

  • No Password Recovery: Because we possess no backdoor keys or cloud access, forgotten passwords cannot be recovered by our team.
  • Physical Device Security: If your local computer is infected with keyloggers or malware, browser memory could theoretically be inspected locally by malicious software on that machine.
  • No Independent Audit Claim: While built on audited open-source foundations (Web Crypto, Mozilla PDF.js), this specific web assembly has not undergone a formal third-party commercial penetration audit.

For complete details on data privacy, review our Privacy Policy or test local processing directly via our Verification Guide.