Security
Measures that are actually implemented. Limitations are listed too.
Files are identified by their contents
Every file is checked against known byte signatures before anything touches it. A .jpg that is really a ZIP is treated as a ZIP. The extension is only ever used as a hint for plain-text formats that have no signature.
Nothing uploaded is ever executed
Your file is only ever read as data — decoded as an image, parsed as a PDF, unpacked as a ZIP container. It is never evaluated as code, and there is no server-side handler that could run it.
Filenames are sanitised before use
Path separators, traversal sequences, control characters and reserved device names are stripped from every name before it is used for a download or a ZIP entry.
A strict Content-Security-Policy
The page may only load code from an allow-list, and everything not on it is refused by the browser rather than by us. Three things are on it: Google AdSense, which pays for the site and runs on every page; the payment provider’s checkout, on the checkout path only; and the LaTeX engine, served from this origin. Nothing else may run, and no code may send a file anywhere.
Size, count and time limits
Every operation is bounded: a maximum file size, a maximum batch, and a processing timeout that stops a runaway job rather than freezing the tab.
Payment secrets never reach the browser
The provider’s secret key and webhook secret exist only in server environment variables. The browser receives a public key and an order id, and nothing else.
Payments are verified server-side
Credits are granted only after a signature is checked against our secret and the provider is asked directly what state the payment is in. A message from the browser claiming success is not enough, and a replayed one grants nothing.
Encryption uses a real cipher
PDF password protection is AES-256 through a maintained implementation of the PDF security handler. The password is used in your browser and stored nowhere.
Being straight with you
What this does not protect against
Because processing happens in your browser, the code that decides whether a tool may run is code you could in principle change. Usage counters and credit balances are held on the server and enforced there, but a determined person running the processing library directly on their own machine is not something any browser-side product can prevent — and honestly, the library is open source anyway.
FixIt also cannot vouch for the safety of a file you were sent by someone else. It will tell you what the file really is, which is often the useful part, but it is not an antivirus.
See also how your files are handled.