Irfan PDF

Security & privacy

Determined from the code, not from marketing

Every statement on this page was read out of the shipped source and test suites. Anything that could not be confirmed is listed as Not Verified at the bottom.

Verified in codePrivacy policy

Digitally signed documents

A digitally signed PDF is refused for OCR and export operations with a clear message. Adding a text layer would break the signature, so the app does not attempt it. This is a deliberate preservation behaviour, tested in the regression gate.

Local processing

  • Server binds to 127.0.0.1 only — never a public interface
  • OCR runs on bundled ONNX models (RapidOCR), no cloud calls
  • PDF processing is done by the bundled PyMuPDF runtime
  • All data lives in the application's own data folder on disk

Evidence: server/config.py (HOST/PORT), grep: zero HTTP clients in server/ and web/js/

No internet, no telemetry

  • No requests/httpx/urllib usage in the application code
  • No telemetry, analytics, tag managers or crash reporters
  • No account is required (sign-in is optional and off by default)
  • Nothing is sent anywhere: the app works with the network cable out

Evidence: grep telemetry|analytics|sentry|gtag → no matches (2026-10-16)

Accounts & passwords (optional)

  • Passwords stored as PBKDF2-HMAC-SHA256, 600 000 iterations, per-user salt
  • Login rate limit: 5 failures per 5 minutes per IP
  • Last administrator cannot be demoted or removed
  • ADMIN / USER roles with per-tool permission masks
  • Session bound to client identity, token forgery and replay tested

Evidence: _test_auth_users (71), CHANGELOG 1.6.0 / 1.7.0

Request hardening

  • DNS-rebinding Host check: only 127.0.0.1 / localhost / ::1 accepted
  • Browser Origin checked on unsafe (POST) requests
  • Cross-site POSTs refused (415 / 403) — even with a permissive CORS header
  • 512 MB request body ceiling; slow-loris timeouts and per-IP connection caps
  • X-Content-Type-Options: nosniff, SAMEORIGIN frame, no-referrer policy
  • No raw tracebacks or file paths in client-facing errors

Evidence: CHANGELOG 1.7.0 (8 + 4 findings), regression gate 2026-10-17

Document integrity

  • Digitally signed PDFs are refused with an explanation, never silently modified
  • Encrypted PDFs are refused with a named fix, not a dead end
  • Saving over the original file is refused (409) — output is always a new file
  • Redaction deletes characters permanently; the app re-reads the output to prove it

Evidence: regression gate 2026-10-17, test_security_pages (73), _test_password_pdf (23)

Logging & diagnostics

  • Operational logs stay in the local data folder
  • Diagnostic report export exists for support — you choose when to share it
  • No document content is uploaded for “improvement” purposes

Evidence: server code + README.md §7, INSTALLATION-GUIDE.md

What is NOT verified

Stated openly because a privacy page that hides gaps is not a privacy page.

  • An independent third-party security audit — no such report exists in the project files.
  • Formal penetration-test results.
  • A bug-bounty or vulnerability disclosure channel (none is published in the project).
  • Code signing of the installer (Artifacts are Authenticode: NotSigned).

Internet requirements

None. The application performs no network operations — not for OCR, not for updates, not for telemetry. The website you are reading is separate from the application and makes its own requests to serve these pages.