Skip to content
convertexa

Security

Last updated 2026-10-21

A file converter is a program that reads untrusted data. Here is exactly how convertexa handles that.

Client-side execution

All conversion code runs in the browser. The server only delivers static files; there is no API that accepts a document, so there is nothing for us to leak.

Sandboxed workers

Image, archive and font conversions run inside a dedicated Web Worker. The engine only receives the file bytes and the requested settings.

Untrusted input handling

Archive entries are sanitised: path traversal sequences are stripped, entry counts and total sizes are capped, and archive entry names are never used as real paths.

No third-party scripts on the conversion path

Advertising scripts are loaded lazily, only when an ad slot approaches the viewport, and they run on the page rather than inside the conversion worker.

HTTPS only

The site is served over TLS with HTTP/3 enabled and HSTS enabled, so the connection is encrypted end to end.

Transparent dependencies

Every open-source engine convertexa relies on is listed with its licence on the licences page, including the GPL obligations of the FFmpeg build.

Responsible advertising

Ad slots are clearly labelled, never overlap the converter, and are loaded without blocking the main thread. Disabling them removes all ad code paths.

Found a vulnerability?

Please report it responsibly:

  1. Describe what you did, what you expected and what happened.
  2. Include the browser and version, and the type of file you used (no need to share the file itself).
  3. Send it to security@convertexa.com.