What this site connects to
This is the complete list of network requests text2pdf.online can make.
Requests your browser makes
| What | Where | When | What it carries |
|---|---|---|---|
| The page itself | text2pdf.online | When you open the site | Nothing beyond a normal page load |
| Fonts | text2pdf.online/fonts/… | Only when a page or document needs a script you haven't loaded yet | Nothing. Self-hosted - no Google Fonts, no CDN |
| Your file, for conversion | text2pdf.online/api/convert | Only when you convert on the server - never in browser mode | The file's bytes. Not its name |
| Page-view count | text2pdf.online/_vercel/insights | On page load | Which page was viewed. No cookie, no persistent ID, nothing about your document |
Every entry is on this domain. There is no fifth row.
Requests the converter makes
None. The headless browser that renders your document has its network access switched off - every request it attempts is aborted except the bundled fonts, which are served to it from memory. This matters more than it sounds: a Word document can reference an image hosted elsewhere, and a converter that fetches it would be making a request on your behalf, to a destination the document's author chose, telling that third party your document was being converted and when.
Never, under any circumstances
- No Google Fonts, Google Analytics, or any Google service
- No advertising or marketing network, ever
- No CDN - every asset is served from this domain
- No error-reporting service (they receive stack traces, which can contain data)
- No social media embeds, share buttons, or trackers
- No cookies at all - which is why you have never seen a cookie banner here
How to check this yourself
- Watch the network. Open your browser's developer tools, go to the Network tab, and convert a file. Compare what you see against the table above.
- Tick “Convert in my browser” on the home page with a .md or .txt file. The Network tab stays empty apart from fonts. Your file is never sent anywhere, and you can see that it isn't.
- Read the policy the browser enforces. Every response carries a Content-Security-Policy header including
connect-src 'self'. That is not a promise, it is an instruction to your browser: it will block any attempt to send data off this domain, including one we made by mistake. Check it under Response Headers. - Block us and see what breaks. Put this site behind a proxy, a firewall or an extension that logs outbound connections. Nothing on the list above is optional padding - if we were reaching anywhere else, that is where it would show up.
What this page cannot tell you
This covers what the site does. It does not cover our host: text2pdf.online runs on Vercel, whose platform keeps its own short-lived request records - timestamps, IP addresses, response codes - the same as any web host and entirely outside our code. We never put your document, its name, or anything about it into those records, but we cannot make them not exist. If that matters for a particular document, use browser mode: with nothing sent, there is no request for anyone to record.
Accurate as of v2.5.1. For feedback write us to hello@text2pdf.online