The awkward moment is small and routine. Four scans need merging. A bundle needs numbering. A form needs filling. The obvious tools are free web converters, and every one of them begins by asking you to hand over the file.

That is not a failing on their part — it is their architecture. Converting a PDF on a server costs real money, so the file has to reach the server, and once it is there the usage has to be metered, which means an account, which means a subscription. Every constraint follows from the first one.

So we moved the work to where the document already is. Modern browsers can parse and write PDFs perfectly well on their own. Once the processing happens on your machine, the whole chain of consequences unwinds: nothing to upload, nothing to meter, no account to create, no reason to charge, and no server that could be breached because there is no server.

Ofcpdf is short for Office PDF — the office-document work a PDF spends most of its life doing (merging, numbering, stamping, form-filling, signing) rather than the heavier, less common editing a full desktop suite is built around.

What we believe

A privacy claim you cannot check is marketing

We do not say "zero bytes transferred", because the application itself has to reach your browser once and that would be a lie you could catch in thirty seconds. We say something narrower and true: your documents never need to be uploaded. The source is public, the Content Security Policy is enforced by your browser rather than by our good intentions, and the app carries a monitor that lists every request the page has made.

Refusing beats faking

If we cannot safely rewrite a PDF, the app stops and tells you, and your original is untouched. It will never hand you a file that looks right and is quietly broken. This costs us features. A tool that silently corrupts a contract or a medical record is worse than no tool at all.

We would rather say "not yet" than fake it

Permanent redaction was the feature most people asked for, and for a long time we did not have it — because a black rectangle drawn over selectable text is not redaction, it is a trap that has embarrassed governments and law firms with real consequences, and we were not willing to ship that and call it done. It now actually removes the marked content from the page's own structure, and every export independently re-verifies the removal and shows you the result rather than asking you to trust it. How that actually works explains it plainly, and the roadmap says what else exists and what does not, including the one honest limitation this still has (a rotated page is covered but not yet rewritten, stated on the redaction tool itself, not hidden in fine print).

How it is funded

By adverts on the information pages, and nothing else. Serving static files to a lot of people costs very little, and the expensive part — processing your document — happens on your computer at your expense, which is roughly nothing. There is no free tier because there is no paid tier. The information pages carry adverts, which you can decline, and which never run inside the editor. These same pages also use Google Analytics, disclosed here rather than gated behind a consent click, since it only ever produces an anonymous, aggregate page-view count — it never runs inside the editor either. We have no data of our own to sell, because our own analytics never see anything more sensitive than which pages were visited.

If that changes we will say so on this page before it changes anywhere else.

What it does, and what it does not

Most tools list only the first half. Both halves are here because a claim you can check is worth more than a claim you cannot.

It does

Keeps your file on your device: Every operation runs in your browser, so no document is ever transmitted anywhere.
Works with no internet: Load it once and it keeps going offline. Or install it, and it opens in its own window with no connection.
Free, with no limits: No page caps, no daily quota, no watermark, no account, no email address.
Edits text already on the page: Click a line, and it is covered in the colour of the paper behind it with an editable copy on top in matched type.
Shows what is hidden in a file: Metadata naming the author, scripts, attachments, text positioned off the page — none of it visible until you look.
Checks its own work: Every export is reopened by a second engine and verified before you are told it worked.
Never touches your original: Output is always a new file. A mistake costs you a re-run, never the document.
Proves it rather than promises it: Your browser blocks transmission from the editor at the platform level. Open the network tab, or disconnect the internet and keep working.

It does not

Redact permanently: A shape over text hides it and leaves it selectable underneath. Until we can remove content and prove it is gone, the answer is no.
Read scanned pages: No OCR yet. A scan stays a picture.
Reflow a paragraph: You can replace a line of existing text and it exports as real text. What you cannot do is re-wrap the paragraph around it — that corrupts layout in ways that are hard to spot.
Convert to Word or Excel: Rebuilding an editable document needs far more compute than a browser tab should attempt.
Open a password-protected file: We cannot decrypt, so we refuse and say so rather than handing you an empty-looking file.
Sign cryptographically: Signatures here are visual. That is what most documents need, and we label it honestly.

Wondering how that compares with a tool that processes your file on its servers? The difference is set out here, including the jobs a server-based tool still does better.

How you can check us

A privacy claim you cannot test is just advertising, so the important ones here are enforced by your browser rather than by our intentions.

The Content Security Policy. The editor is served with a policy permitting no third-party origin at all. Your browser blocks transmission whatever our code attempts. Read the response headers yourself.
The network tab. Load a document, edit it, export it. After the application files arrive there is no further traffic.
Disconnect. Pull the connection and keep working. Software that needed to send your file somewhere could not.

Where we are

You can reach a human at hello@ofcpdf.com or through the contact page.

About us