Local file processing: privacy, PDF and image limits

What happens after you choose a file?

Selecting a file gives the page access to that file for the chosen operation. KitForma reads its contents into browser memory, decodes the supported format and produces a new result. Image operations use browser image and canvas facilities; PDF operations use document libraries and, where required, a PDF rendering worker. Background removal runs a downloaded model in a browser worker. These are different processing paths, not one remote conversion service.

The application creates preview and download objects from the result. A download saves a new copy; it does not overwrite the selected original. Save the result before leaving the tool. Closing or reloading the page ends that working session, while files you already downloaded remain on your device. This is a description of application behavior, not a claim of secure erasure from browser or operating-system memory.

Local processing still involves network traffic

The browser downloads the page, JavaScript, fonts and other application assets. Some processing libraries load only when needed. Background removal fetches its model and runtime files; PDF rendering can request bundled fonts and related support files. Those requests deliver processing software to the browser. They do not require the selected document or photograph to be sent to a conversion server.

Loading the site sends ordinary connection information, such as an IP address and requested URL, to hosting providers. When configured, Google Analytics, PostHog and Cloudflare Web Analytics start only after the current explicit combined analytics choice that names them. An older Google Analytics choice does not activate the newer combined features. Google Analytics uses cookies; PostHog uses a random identifier in this tab’s sessionStorage; Cloudflare Web Analytics does not use analytics cookies.

With permission, measurement can include public page visits, loading times, tool attempts and limited technical error categories. Optional feedback sends the choices you submit. Session replay and automatic click/form tracking are off; files, filenames, entered values, results and account identity are excluded. Do Not Track (DNT) and Global Privacy Control (GPC) block collection; private account, billing and support routes are excluded. Use Analytics settings to decline or withdraw. Withdrawal stops new measurement but cannot recall data already received; hosting security remains separate.

Optional accounts can save workspace settings, and Pro is a separate paid subscription. Cloud AI sends the text you approve to the named provider; cloud saving and Etsy transfers send your selected content after authorization. Standard local conversion does not require these transfers. Favorites and local drafts can persist in browser storage. Read the privacy notice for each optional feature; local processing is not an independent security certification.

Read PDF limits together, not one at a time

The PDF document tools allow up to 40 MiB per input file and 100 MiB of input in one job. Merge accepts 2–20 files; most other PDF tools accept one source PDF. Each source must have no more than 300 pages, and the merged result also cannot exceed 300 pages. PDF and ZIP results are capped at 150 MiB; splitting additionally checks the combined size of the generated PDFs before packaging them.

The interface labels these binary file-size units as MB. In this guide, 1 MiB means 1,048,576 bytes. File count, combined bytes, page count and the operation-specific limits all apply. For example, three 35 MiB PDFs pass the individual 40 MiB check but total 105 MiB, exceeding the combined 100 MiB limit. A single file above the input limit cannot be made acceptable simply by selecting a short page range after opening it.

These PDF document limits are not the limits for Images to PDF. That tool starts with image files and uses the image selection limits described below. It creates image-based pages rather than adding searchable text through OCR.

PDF document inputs
Per file: 40 MiB
Combined input: 100 MiB
Merge: 2–20 files, up to 300 pages in the result
Other document tools: one source PDF
PDF / ZIP output cap: 150 MiB

Rendering and text extraction have additional ceilings

PDF structural optimization is separate from raster compression. It repacks the whole document without rendering pages, so the raster page and DPI settings below do not apply; the standard PDF file and 300-page caps still do. It returns the unchanged original if repacking saves no space. Encrypted, signed and XFA documents are unsupported.

PDF to images, raster PDF compression and grayscale conversion process at most 60 selected pages. Rendering is limited to 12,000,000 pixels per page, 180,000,000 pixels across the job and 8,192 pixels on either page edge. The DPI control permits 72–200 DPI, but a large-format page can exceed the pixel limits even at an allowed DPI. Reduce the resolution or selected page count when the tool reports this.

Text to PDF accepts up to 100,000 JavaScript string units of input; PDF text extraction stops at 2,000,000 units, including its page markers. These are not word limits: a supplementary Unicode character such as some emoji occupies two UTF-16 units. Text extraction reads an existing text layer and does not recognize words in scanned page images.

A compressed source file can expand substantially when decoded into pixels and intermediate results. That is why a short, highly compressed scan may consume more working memory than its file size suggests. No completion time or minimum device memory is guaranteed by these upper limits.

Image batches and single-image tools are different

The shared Convert, Compress, Resize, HEIC to JPG and Images to PDF workflow allows up to 20 selected images, each no larger than 25 MiB and 40,000,000 decoded pixels. Inputs are JPG, PNG, WebP, HEIC or HEIF. There is no separately enforced combined-byte ceiling in that workflow; multiplying the per-file limit by the file count does not establish that a device can process that much data successfully.

In a conversion batch, images are processed one after another and the interface shows each result or error. One failed item does not establish that all the other downloads failed. Images to PDF instead assembles the selected images into one PDF. A batch here is a list inside the current tool session, not a resumable server queue or an automatic sequence across multiple tools.

The separate image editor accepts one image at a time. Its general file cap is 25 MiB, with smaller caps of 2 MiB for SVG to PNG and 3 MiB for Image to Base64. Background removal has its own 20 MiB input cap and 40,000,000 decoded-pixel limit; output keeps the aspect ratio and is limited to 2048 pixels on the longest edge.

Target-size image compression may lower quality and dimensions to try to meet the requested KB value. It can report that the target was missed. Check the final bytes, dimensions and appearance against the receiving form’s requirements; neither an exact target size nor unchanged detail is guaranteed.

Plan a job around the required output

Start with one representative, non-private file. Check whether the intended output must preserve searchable text, form fields, transparency or exact dimensions before scaling up to the rest of the batch. Splitting work into smaller groups can reduce peak resource use, but cannot make an unsupported format or required feature become supported.

1. Keep originals and note the required page count, file type and size limit.
2. Run one sample and open the downloaded result in the application that will actually use it.
3. Check both visible quality and behavior: search text, try required links and inspect form fields.
4. Process a manageable group, save completed results and check any per-item errors before continuing.
5. If the tab runs out of resources, try fewer pages or smaller inputs; use a suitable alternative when the original itself exceeds an input cap.

Inspect a synthetic operation yourself

The tool pages provide synthetic examples, including a three-page PDF and an image without personal data. Use those for a network inspection instead of uploading a real document to an unrelated analysis service. The source ZIP linked below includes the application code, including the file-processing paths and limit checks.

In a desktop browser, open its Network developer tool before loading the page. Keep all request types visible. After the page loads, select a synthetic file, run the tool and inspect requests initiated during that operation: their destinations, request data and initiators. Expected software downloads can appear at this stage. Compare the result with the source rather than treating the absence of a request in one screenshot as a universal guarantee.

Note the page, date, operation and analytics choice so the check can be repeated. Do not share network archives from private sessions because they can contain cookies or other sensitive request data. One observed operation and a published source archive are useful evidence to inspect; neither is an independent security certification or proof about every future deployment.