Caspenda PDF

Security

Caspenda PDF does not claim that a PDF is safe, malware-free, sanitized, or free of all hidden information.

Current security behavior

• Unsupported or incomplete inspection areas are shown as partially checked rather than silently treated as absent.
• Page-edit and conversion tools re-open generated output before enabling download and verify the invariants each tool claims to preserve.
• Protect PDF adds an AES-256 opening password to an unencrypted PDF. Unlock PDF removes encryption only when the current opening password is supplied. Password cracking, brute-force, guessing and recovery are not provided.
• Ordinary AcroForm fields with verified appearance streams can be flattened into static page content. XFA remains unsupported. Supported Portfolio/attachment structures, bookmarks and page labels are removed only with an explicit downgrade notice and post-export verification; signed PDFs, active JavaScript/actions and structures that cannot be safely verified remain refused.
• Metadata Check can report signature records exposed by PDF.js, but it does not validate signer identity or signature trust.
• Current browser tests include audits for external document-derived requests and upload-like requests. Protect/Unlock tests also check that test passwords do not appear in the page URL or browser console.

Protect and Unlock verification

Protect and Unlock run in a dedicated browser Worker backed by a self-hosted qpdf WebAssembly module. Protect verifies AES-256 encryption, password requirement and page count before download. Unlock verifies that encryption is removed and page count is unchanged. The security Worker is terminated after inspection or processing to release its temporary memory.

Image to PDF verification

The Image to PDF flow re-opens generated PDFs and checks page count, A4 page geometry and image paint presence. It does not yet claim independent pixel-level visual equivalence. Fit keeps the full image; Fill is explicitly labeled as cropping edges.

No security score

A property being found is not the same as being dangerous. A property not being found is meaningful only inside the stated inspection scope.