Safety & limits
What it never does with your files, and what it can't promise. Read this before using it with work files or on a public service.
Your files are not sent anywhere
Conversion finishes on the machine that runs it. There is no upload, no network call and no usage tracking. You don't need an account.
What's inside a file is never run
- Macros, scripts, form submissions and links to outside resources are shown or skipped, never executed.
- A PDF that needs a password to open is refused, not cracked.
- A PDF whose only restriction is an owner password (for example "no printing") opens the way it does in any viewer. Those restrictions are declarations, not access control, and document-svg does not enforce them. Decide whether that is acceptable before converting such files.
Limits that protect your machine
File size, archive contents, XML size and page count all have upper limits, so an oversized or malformed file can't eat all the memory. An archive with more than 100,000 entries is refused before anything is unpacked.
The limits can be changed, but don't raise them just to push a difficult file through.
Existing files are not overwritten
The output folder must be new or empty, and existing files are never overwritten.
Showing the result
Show SVG pages as images. Don't insert their markup directly into your page. The display helpers do basic checks, but they are not a general-purpose SVG sanitizer.
Running it on a public service
If strangers can upload files, treat every file as untrusted. Run conversion in a separate, restricted process with its own memory and time limits.
What it can't promise
- Pages are not guaranteed to match the original pixel for pixel. Warnings tell you where they may differ, but zero warnings is not a guarantee either.
- Writing back to Office or CAD keeps how the page looks, not its paragraphs, cells, formulas or charts.
- Some formats are shown as a summary of their contents, not the full drawing.
- Medical images and reports are not anonymized. Any personal information inside the file can still appear in the output.
- Warnings are a signal to review, not a certificate of safety or accuracy.
Found a security problem?
Please report it privately through GitHub's vulnerability reporting, not in a public issue. Only the latest release receives security fixes.