Skip to content

PDF-SDK 2.4.1 is out.See what’s new

PDF-SDK
Security

Your documents never leave the device.

PDF-SDK is an on-device PDF SDK: the editor and its engine run inside your app or the browser tab. There is no document server to trust, because no document is ever sent to one.

Start free trialRead the licensing guide
  • No document serverDocuments are opened, edited, signed and saved inside your app.
  • No network with a standard keyThe key is checked on the device. Nothing is sent, ever.
  • No secrets in your appOnly a public key ships in the SDK; a license key unlocks only the apps it names.
  • Signing keys stay putIn the device’s keystore — or in your own HSM or signing service.

Where your users’ documents go.

Nowhere. Everything inside the dashed box happens on the user’s phone, tablet, computer or browser tab.

The user’s device

  1. Your appOpens the editor with a document and gets the edited PDF back.
  2. PDF-SDK editorOpens, edits, fills, signs and saves — all in memory on the device.
  3. Your storageWherever your app keeps files. The SDK only hands the bytes back.

Online licenses only: the key, the app’s identity and the SDK version

License serverAnswers active, payment due or suspended. It never receives a document.
With a standard license key there is no connection at all: the key is checked on the device.

Exactly what we receive — and what we never do.

Never sent to us

  • The documents your users open, and the files they save
  • Page content, form values, annotations and signatures
  • Names, accounts, device identifiers or other user data
  • Private signing keys

Sent by an online license check

Online licenses only. Standard keys send nothing.

  • The license key
  • Your app’s identity: bundle identifier, package name or web origin
  • The SDK version
  • Like any web request, an IP address, a User-Agent and a language. The iOS and Android SDKs identify themselves only as “PDF-SDK/<version>”.

Kept by the license server

For usage charts — nothing else.

  • The license, app, SDK version and the answer it gave
  • The language, where it is sent; for web apps, the OS, browser and device class from the browser’s User-Agent
  • Never the key or the IP address — only a one-way hash of the address under a salt that changes every day, to count devices for that day
  • Individual requests are deleted after 35 days; daily totals are kept

Licensing with no secrets in your app.

  • Signed keys, checked on the device

    A license key is signed with Ed25519 and verified inside the SDK — format, signature, expiry, platform and app — without a network call.

  • Only a public key ships

    The SDK carries the public key that verifies licenses. The private signing key never leaves the machine keys are issued on.

  • A key unlocks only its apps

    Each key names the bundle identifiers, package names or domains it covers, so a published key is no use to anyone else.

  • Confirmations that cannot be replayed

    An online license’s confirmation is signed, and the SDK accepts it only for this key, this app and the request it just made.

Signing keys never leave the device.

A digital signature is only as safe as its private key. PDF-SDK keeps it where the platform protects it best — or out of the SDK entirely.

Digital signatures
iOS and iPadOS
In the Keychain, for this device only and only while it is unlocked — so the key does not travel in a backup to another phone.
Android
In the Android Keystore, hardware-backed where the device supports it.
Web
A Web Crypto key that cannot be exported, kept in the browser’s own storage for your site.
Your own signer
An HSM, a remote signing service or a hardware token: the SDK hands over a SHA-256 digest and gets the signature back. It never sees the key.

Don’t take our word for it.

Two checks you can run in a few minutes.

  1. 1In the browser. Open the live demo with your browser’s network panel open, then open a PDF, edit it, sign it and save it. No request carries your document.
  2. 2In your app. With a standard trial key, turn on airplane mode. The editor opens, edits and saves exactly as before.
  3. Open the live demo

Security questions.

Found a vulnerability?

Please tell us privately before you publish it, so we can fix it for everyone first.

Report it privately

No. The editor runs inside your app or the browser tab, and documents are opened, edited, signed and saved there. There is no document server, ours or yours.

With a standard license key the SDK makes no network call at all. An online license asks the license server for a confirmation from time to time; the server keeps usage counts from those requests — never the document, the key or the IP address.

Yes, with a standard license key: it is checked on the device and needs no connection. Online licenses work offline between confirmations — 30 days by default.

On the device: the iOS Keychain (this device only), the Android Keystore, or a non-exportable Web Crypto key in the browser. You can also sign with your own HSM or signing service; the SDK never sees the private key.

Yes. Your app passes the password when it opens the document, or when it imports pages from one.

Try it in your app.

A free trial unlocks every feature on every platform, in any app. Open a document today.

Start free trial Open the live demo

Talk to us

Questions about licensing, several apps, volume, or OEM and site terms — we will work out what fits.

Talk to sales