Is View PDF's safe?
View PDF's sends every search keystroke and uploaded documents to viewpdf.org and ConvertAPI, which stores files on their servers.
The extension's new tab page transmits each character typed in the search box to viewpdf.org in real time and injects unvalidated remote HTML from that same server directly into the page DOM. When users convert files, the documents are uploaded to ConvertAPI using a hardcoded secret key and retained on ConvertAPI's servers via the StoreFile=true parameter.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Your uploaded documents are sent to a third-party server and retained there
Converted files leave your device: the whole file uploads to v2.convertapi.com, a third party, in one request.
The URL includes StoreFile=true, telling ConvertAPI to keep a copy.
Supports PDF, DOCX, CSV, PPT, PNG, JPG; passwords travel too.
You convert a document using the extension.
For example, you attach a PDF and select 'PDF to OCR'.
The extension uploads the entire file to a third-party service, v2.convertapi.com, and asks it to keep a copy.
Conversion happens on ConvertAPI's servers, not on your device.
| Content-Type | multipart/form-data |
Content-Disposition: form-data; name="file"; filename="document.pdf" Content-Type: application/pdf <full PDF bytes of the file you selected>
| Field | Value | Why it matters | |
|---|---|---|---|
Your document | document.pdf (full file bytes) | The complete file you chose is uploaded for conversion. | |
Retain-on-server flag | StoreFile=true | Instructs the service to keep a copy of your file after conversion. | |
PDF password | Password=hunter2 / UserPassword / OwnerPassword | For Encrypt PDF / Decrypt PDF, the password you type is sent with the file. |
The upload and the StoreFile=true retention flag
// `file` is the user's selected document.
// StoreFile=true => ConvertAPI retains a copy after conversion.
uploadUrl = `https://v2.convertapi.com/convert/${from}/to/${to}?Secret=${SECRET}&StoreFile=true`;
post(uploadUrl, file); // multipart upload of the full document- v2.convertapi.com
Receives the full uploaded document and performs the conversion. ConvertAPI (operated by ConvertAPI, UAB) retains the file server-side because the request sets StoreFile=true.