250 tools23 workspacesZero uploads

Pro-grade file tools that stay on your device

PDFs, media, spreadsheets, code, audio, scans, diagrams, handwriting, photos, resumes, email, passwords and more — processed in your browser, never sent to a server.

  • No account needed
  • Works offline after first load
network · this session
▸ over the wire0 requests
▸ your documents0 requests

Open your DevTools network tab and watch while you work. How it stays private

WebGPU · 1.5B–13B

SafePaper Assistant — private AI chat, entirely on your device

A ChatGPT-style assistant that runs in your browser — no account, no API key, no upload. Smaller models on phones, larger ones on desktops when your device can handle them.

Open Assistant

Free online tools for PDFs, images, video, audio, data & code — processed locally

23 workspaces, one site — PDFs, media, data, dev tools, finance, image AI, audio, health, document scanning, diagrams-as-code, handwriting, photo editing, resumes, email, passwords, security, Assistant, AI, record, share, encrypted storage, archives, and offline data rooms. Each keeps its own queue on this device. Pick a workspace to start.

Start here

Documents & paper

PDFs, scans, resumes, email, diagrams & handwriting

Images, audio & video

Edit, convert, capture & enhance media on-device

Data & developer

Spreadsheets, code, finance & data tooling

Security & privacy

Encrypt, audit & anonymize sensitive files

Store, sync & share

Keep, organize & move files privately

AI & assistant

On-device AI over your own files

Always E2EE

Storage Desk — one encrypted library behind every tool

Not a tool — the place your files live. Save once to an encrypted library that sorts itself, then reuse those files in any tool. Keep it on this device or in your own cloud bucket; nothing is ever uploaded to us.

This deviceBring your own S3 / R2
Open Storage Desk

Jump straight in

Built for files you can't upload

When the file is the sensitive thing, it has to stay on the machine that opened it.

Most “free online” tools upload your file first. SafePaper processes it in your browser — contracts, payroll exports, JWTs, and medical data stay with you.

Frequently asked questions

  • Is it really free?

    Yes. Every tool runs in your browser, so there is no server cost per file and no account, paywall, or usage cap.

  • Do my files ever leave my device?

    No. Files are processed in your browser tab and never uploaded. There is no upload endpoint — open your DevTools network tab and confirm it yourself.

  • Does it work offline?

    After the first load the app shell and most engines are cached, so the tools keep working without a connection. Some AI models download once, then run offline.

  • What's the file size limit?

    There is no server limit. The practical limit is your device's memory, since everything is processed locally in the browser.

  • How is this different from Smallpdf or iLovePDF?

    Those services upload your file to their servers to process it. SafePaper does the work in your browser, so your documents never leave your machine.

  • Is it open source?

    The processing runs entirely client-side, so you can inspect exactly what the page does in your browser's developer tools and network tab.

Technical transparency

SafePaper is built so your PDFs are processed in your browser, not on SafePaper servers. The sections below explain this in plain language.

Hosting & delivery

  • The site is a Next.js (App Router) application. Production is static HTML, JavaScript bundles, CSS, and assets—served like any modern front-end (e.g. on Vercel).
  • There is no Route Handler, no pages/api, and no server action that accepts your PDF for processing. We do not operate an upload endpoint for document bodies.

Runtime (your machine)

  • UI is React 19 + TypeScript, styled with Tailwind CSS, with motion via Framer Motion where noted in the interface.
  • Dropped files are read with the browser File API into ArrayBuffer / Uint8Array and kept in client-side React state (a shared provider across tool pages in one visit). The visible queue is also mirrored to sessionStorage when it fits browser limits so a refresh in the same tab can restore filenames and bytes without contacting a server.
  • Heavy merge, split, organize, compress, crop (CropBox and multi-region PDF exports), and redact PDF output runs in a dedicated Web Worker (pdf-operations.worker.ts, compress-pdf.worker.ts, bookmarks-outline.worker.ts, extract-embedded-images.worker.ts, crop-pdf.worker.ts) so the main UI thread stays responsive. Buffers are passed with postMessage + Transferable where supported to avoid extra copies.
  • Organize's optional duplicate-page scan runs in pdf-duplicate-pages.worker.ts with pdf.js + OffscreenCanvas—still only on your device.

Security Vault

  • Security Vault (/security) runs JWT decode, hashing, AES file encrypt, key generation, TOTP, bcrypt, and Shamir sharing with Web Crypto and jose in your tab only.
  • Optional site analytics and the consent banner are disabled on Security Vault routes even if you opted in elsewhere—so secrets pasted here are not on pages that load Vercel Analytics.

Share Desk (peer-to-peer)

  • Share Desk (/share) transfers files with WebRTC data channels directly between two browsers. SafePaper does not store or process file bytes on our infrastructure.
  • A separate WebSocket signaling service (configured via NEXT_PUBLIC_SIGNALING_URL) relays SDP offers/answers and ICE candidates so peers can find each other. That relay carries connection metadata only—not your file contents.
  • Large receives stream into OPFS via opfs-writer.worker.ts so the main UI thread stays responsive. Senders read files in 64KB slices with data-channel backpressure.
  • Peers may use Google's public STUN (stun:stun.l.google.com:19302) to discover network paths. Optional TURN env vars (NEXT_PUBLIC_TURN_URL, etc.) can relay traffic on restrictive networks—that is separate third-party network traffic, not a SafePaper file upload.

PDF stack

  • Structural PDF work (merge order, page extraction, rotation, removal) runs in the worker path described above.
  • Optional password protection applies AES-256 encryption on the main thread after the worker returns bytes, using the browser's Web Crypto API. Your open password is not sent to any server.
  • Previews and raster export (PNG images and plain-text extraction) use a canvas-based PDF renderer in a separate worker. The preview worker script is served as static /pdf.worker.mjs from this site. CMaps, standard font metrics, ICC profiles, and WASM helpers for pdf.js live under /pdfjs/ (copied from pdfjs-dist on npm install) so workers can fetch glyph data from the same origin.
  • That preview worker is separate from the merge/split/organize worker; both use Web Workers and stay entirely on your device.

Network & storage

  • Over the wire you should see requests for the app shell, JS chunks, CSS, fonts (next/font self-hosted subsets), icons, the PDF preview worker script, and (after npm install) same-origin OCR assets under /tesseract/—not outbound uploads of your document to SafePaper for processing.
  • Downloads use normal browser mechanisms (Blob / URL.createObjectURL) initiated by you.
  • By default, tools do not persist your PDFs to SafePaper storage; lifetime is in-memory for that tab session (and the shared client state resets when you leave the tool area for the home page).
  • Storage Desk (/storage) is the one place where files are kept on purpose—and it is always end-to-end encrypted. A single passphrase derives an AES-256-GCM key with Argon2id inside a Web Worker; the key stays in memory only and is never written to disk or sent anywhere. File bytes and metadata (titles, categories, filenames, search embeddings) are encrypted before they touch any backend.
  • You choose the backend: Browser (OPFS + IndexedDB on this device) or bring-your-own S3 (Cloudflare R2 or any S3-compatible bucket, reached directly from your browser via SigV4). With BYO-S3, only opaque ciphertext—including the synced catalog.json index and a vault.json manifest (a non-secret salt + Argon2 parameters + an encrypted verifier, so a second device with the same passphrase can derive the same key)—lands in your bucket; SafePaper never receives it, and neither the key nor your passphrase is ever stored.

Tool-by-tool: where work runs

Tool / areaWhere work runsExtra network
Merge, split, organize, protectBrowser + workersApp shell only
Compress, redact, cleanBrowser + workersApp shell only
Export (PNG / JPEG / text)Browser (pdf.js canvas)App shell only
Forms, watermark, page #, insertBrowser (pdf-lib)App shell only
OCRBrowser (pdf.js + Tesseract)Same-origin WASM/worker/lang after postinstall (no third-party OCR CDN)
Duplicate scan (Organize)Browser worker (pdf.js)App shell only
Share Desk (P2P)Browser WebRTC + OPFS workerSignaling WebSocket + STUN (optional TURN) — no file bytes to SafePaper
Media StudioBrowser + FFmpeg WASM (lazy) + image workersSame-origin FFmpeg under /vendor/ffmpeg/
Data ZoneWeb Workers + DuckDB-wasm + OPFS queuesDuckDB bundles may fetch from jsDelivr on first SQL use — not your table rows
Security VaultBrowser Web Crypto + jose (no upload)Analytics disabled on these routes
AI Desk (RAG)Embedding + chat workers; IndexedDB indexOne-time model weight downloads (Transformers.js / WebLLM CDN)
Record DeskCapture + OPFS mux; Whisper workerWhisper ONNX/WASM may fetch from jsDelivr on first caption run
Vision StudioImage inference worker (ONNX / Transformers.js)One-time model weight downloads (Hugging Face / jsDelivr); images stay local
Audio LabFFmpeg WASM worker + Web Audio; Whisper for transcriptionOne-time FFmpeg/Whisper asset downloads; audio samples stay local
Health Deskdicom-parser + canvas; pure-JS HL7/FHIR; localStorage lab historyNone — scans, records, and lab data are parsed and stored entirely on-device
Scan DeskCamera + canvas image pipeline; Tesseract OCR; pdf-lib exportSame-origin OCR WASM/worker/lang only; scans stay on-device
Diagram DeskMermaid + Graphviz (WASM); canvas rasterize for exportOne-time Graphviz WASM fetch; diagram source stays local
Handwriting DeskCanvas render; MediaRecorder + FFmpeg WASM for videoSame-origin fonts + one-time FFmpeg assets; text stays local
Photo DeskCanvas pixel ops; heic-to WASM decode; RAW preview parseOne-time HEIC WASM assets; photos are edited & encoded on-device
Resume Desk@react-pdf render; pdf.js text extract; localStorageApp shell only; resume data stays in your browser's local storage
Email Deskpostal-mime / msgreader / TNEF parse; DOMPurify + sandboxed iframe (CSP blocks remote); @react-pdf renderApp shell only; email files are parsed in your browser, remote images & trackers blocked by default
Password Deskkdbxweb + hash-wasm Argon2; zxcvbn strength; otpauth TOTP; crypto.getRandomValuesApp shell only; KeePass .kdbx vaults are decrypted & edited in your browser — master password never leaves the tab
Archive Deskzip.js + fflate in archive workerApp shell only (central directory parsed locally)
Data Roomcrypto-packager worker + offline HTML exportSame-origin /dataroom-template.html at build time
Storage DeskArgon2id + AES-256-GCM crypto worker; OPFS + IndexedDB; on-device labeling/embeddingsNone for Browser backend. BYO-S3 sends only opaque ciphertext straight to your own bucket (SigV4) — never to SafePaper

“App shell only” means HTML/JS/CSS/fonts and static assets from your host—no SafePaper API that accepts PDF bodies. A production service worker precaches the home page, PDF preview worker, and vendored OCR files for calmer offline reloads after the first visit.

Offline & limits

  • After the app has loaded once, cached bundles mean the core tools can keep working offline for files already held in memory—subject to browser cache eviction.
  • Practical limits are those of the device: available RAM, CPU, and browser tab limits. Malicious PDFs are still a local execution concern the same way opening a file in any desktop viewer is; we do not add a separate server-side malware scan because files never leave your machine for our processing.

Design rule

Zero server uploads for PDF work. New tools are expected to follow the same model: browser-first, worker offload where needed, and no silent exfiltration of document bytes to SafePaper infrastructure.

Privacy status

See what this page loaded. Your files stay on your device.

Live privacy status

Your PDF is not sent in requests to SafePaper. This section shows what your browser loaded on this page so you can verify that yourself.

Your PDF sent to SafePaper0bytes · by design
Tab requests shown
0
Bundles, CSS, fonts…
0
fetch / XHR rows
0
Downloaded (assets)
—

How to read this: PDF work happens on your device. The rows below are usually app files like scripts, styles, fonts, and worker files. Seeing requests here is normal; your actual PDF content should not be uploaded to SafePaper.

Network rowsTap for full list

No network rows yet. Reload once and they should appear after the page finishes loading.

Analytics preferences

You have not chosen yet — use the bar at the bottom of the screen, or choose below.

Optional analytics uses Vercel Web Analytics and Speed Insights for aggregated page and performance data only. We do not attach your PDFs or their contents to these tools.

Read the Privacy Policy section