Is View PDF's safe?
View PDF's sends every search keystroke and uploaded documents to viewpdf.org and ConvertAPI, which stores files on their servers.
The extension's new tab page transmits each character typed in the search box to viewpdf.org in real time and injects unvalidated remote HTML from that same server directly into the page DOM. When users convert files, the documents are uploaded to ConvertAPI using a hardcoded secret key and retained on ConvertAPI's servers via the StoreFile=true parameter.
Who publishes itView PDF - 1 other listing from the same operator, none carrying a finding
View PDF - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 543 users between them, none of them carrying a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Your uploaded documents are sent to a third-party server and retained there
Converted files leave your device: the whole file uploads to v2.convertapi.com, a third party, in one request.
The URL includes StoreFile=true, telling ConvertAPI to keep a copy.
Supports PDF, DOCX, CSV, PPT, PNG, JPG; passwords travel too.
What actually happens
You convert a document using the extension.
For example, you attach a PDF and select 'PDF to OCR'.
The extension uploads the entire file to a third-party service, v2.convertapi.com, and asks it to keep a copy.
Conversion happens on ConvertAPI's servers, not on your device.
Captured request
Observed during dynamic analysis: a test PDF was attached, and a marker placed inside that PDF was captured inside this outbound request, confirming the document content leaves the device.
- Content-Type
- multipart/form-data
Content-Disposition: form-data; name="file"; filename="document.pdf"Content-Type: application/pdf<full PDF bytes of the file you selected>What is included in the upload
- Your documentdocument.pdf (full file bytes)
The complete file you chose is uploaded for conversion.
- Retain-on-server flagStoreFile=true
Instructs the service to keep a copy of your file after conversion.
- PDF passwordPassword=hunter2 / UserPassword / OwnerPassword
For Encrypt PDF / Decrypt PDF, the password you type is sent with the file.
The code that does this
The upload and the StoreFile=true retention flag
The whole file leaves the device; StoreFile=true keeps it server-side
script.js// `file` is the user's selected document.// StoreFile=true => ConvertAPI retains a copy after conversion.uploadUrl = `https://v2.convertapi.com/convert/${from}/to/${to}?Secret=${SECRET}&StoreFile=true`;post(uploadUrl, file); // multipart upload of the full documentWhere your documents end up
- v2.convertapi.com
Receives the full uploaded document and performs the conversion. ConvertAPI (operated by ConvertAPI, UAB) retains the file server-side because the request sets StoreFile=true.
What it can do
Permissions this extension asks for, as declared in version 3.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Run searches with your default search engine
search
Store data in your browser
storage
Where it sends data
Destinations our analysis observed View PDF's contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- v2.convertapi.com
View PDF's sends data to v2.convertapi.com. One other extension we have analyzed sends data here.
- viewpdf.org
View PDF's sends data to viewpdf.org. One other extension we have analyzed sends data here.