Why uploading is the risk
When a website "processes" your PDF, it usually means a copy has been sent to a server. From then on, that copy is subject to the provider's retention settings, backups, staff access and any breach it suffers, and you have no way to check that it was deleted. For confidential material, the safest copy is the one that was never made.
How OpenSigner avoids it
- The PDF is read from your disk with the browser's File API, straight into memory.
- Pages are parsed by pdf.js in a Web Worker and drawn on screen, all inside your tab.
- The signed copy is written by pdf-lib and hashed with WebCrypto, also in your tab, then saved with your browser's normal download.
- The site's Content Security Policy only lets the page connect to its own origin and, for Pro purchases, Razorpay. There is no endpoint that accepts documents.
Check it yourself
Open the signing tool, then switch off Wi-Fi or mobile data before you choose the file. Signing and downloading still work, because nothing needs the network. You can also open your browser's developer tools, go to the Network tab, and watch: no request carries your document.
What stays on your device afterwards
The document itself is not stored by OpenSigner; close the tab and it is gone from memory. Your browser's local storage keeps only your preferences, such as your signer name and last signature image, which you can clear at any time from your browser's site settings.
Limits worth knowing
OpenSigner makes a simple electronic signature with a tamper-evident seal. It does not verify who signed, and it is not a certificate-based digital signature. For confidential documents that must be signed by several parties with identity checks, a hosted workflow service may be required, which means uploading. See our comparison.