Security

File validation

We never trust a file's extension or its reported MIME type. Every file you choose is identified by its actual byte signature, and anything we cannot decode is rejected before any processing starts — renaming a document to .png gets it refused, not misprocessed. Nothing is uploaded at any point; the check runs on your own device.

Resource limits

• Per-file size limit (default 25 MB) to prevent runaway memory use.
• Total pixel-count limit (default 40 megapixels) to guard against decompression bombs.
• Batch count limit (default 20 files) with a bounded processing queue.

SVG handling

SVG is code, not just pixels, so it gets its own pass before anything is drawn. We remove <script>, <foreignObject>, <iframe>, <embed>, <object>, media and animation elements; strip every on… event attribute; restrict href to same-document references and inline data:image/ values; drop embedded stylesheets that use @import or fetch a remote URL; and remove any attribute whose url() points outside the document.

Rasterizing then happens through an <img> element loading a blob URL, which by specification runs no scripts and fetches no subresources. The sanitizer is a second layer rather than the only thing standing in the way.

Content Security Policy

The site ships a Content Security Policy that restricts where scripts, styles, images, fonts and network connections may come from, forbids framing, and pins base-uri and form-action to this origin. connect-src is deliberately narrow: no code path sends image data anywhere, and the policy means a compromised dependency could not quietly start doing so.

Memory hygiene

Object URLs, ImageBitmaps and canvases are released when a file is removed or the page is closed, and workers are terminated on unload — cancelling a batch terminates the worker outright rather than letting the file currently being encoded run to completion. Images are never written to localStorage, sessionStorage, IndexedDB or any other persistent store; an automated test asserts that after a full compress-and-download cycle the only stored value is your theme preference.

Reporting a vulnerability

If you discover a security issue, please email [email protected] with details and steps to reproduce. Please give us a reasonable opportunity to address it before public disclosure.