{
  "id": 10168535,
  "title": "PDF Toolkit Where Your Files Can't Leave the Browser (and the CSP Enforces It)",
  "url": "https://urgent.news/2026/09/27/pdf-toolkit-where-your-files-cant-leave-the-browser-and-the-csp",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-27T07:20:20.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gaurang_learn/pdf-toolkit-where-your-files-cant-leave-the-browser-and-the-csp-enforces-it-jgn"
  },
  "original_language": "en",
  "account": "PDF Toolkit: Files Remain in Browser with Dokwise\n\nDokwise is a collection of 16 PDF and image tools that run entirely in your browser. It offers merging, splitting, compressing, OCR, protection, comparison, scan-to-PDF, and e-signature functionalities. The tool ensures that files never leave your browser, addressing concerns about file security during online processing.\n\nThe core of Dokwise's security lies in its architecture. It is a static site with no backend, no API, and no file-processing server. Processing happens within the browser using libraries such as Job Library, pdf-lib, pdfjs-dist, Canvas + OffscreenCanvas, tesseract.js, AES-256, and @pdfsmaller/pdf-encrypt.\n\nEach tool in Dokwise operates as a plain config object with a process() function. The main user interface consists of shared elements like the drop zone, options, progress bar, and download. New tools can be added through a config and a worker. Workers receive ArrayBuffer's, perform their tasks, and transfer the results back without copying data, enhancing performance.\n\nThe Content Security Policy (CSP) of Dokwise enforces strict rules. It blocks any fetch, XHR, or WebSocket to hosts not listed in the CPS, ensuring no unauthorized data transmission. The only third-party host allowed is Google Analytics, which collects anonymous page views and does not receive file contents or filenames. The CSP also allows tesseract.js to download its dependencies from a CDN after the first visit, making OCR functionality available offline as well.",
  "summary": "Think about the last time you merged two PDFs online. You dragged a bank statement, a lease or a scan of your passport into a website, it \"processed\" the file, and you downloaded the result. Where did the file go in between? Usually it went to someone else's server, and all you have is their word that they deleted it. I wanted a tool where that question has a boring answer, so I built Dokwise :…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}