PDF password protection is not a cosmetic feature bolted onto a file — it is a real, standardized encryption scheme defined in the PDF specification itself, with actual cryptographic algorithms (historically RC4, and in modern PDFs, AES) protecting the document's content streams. Implementing that correctly from scratch is genuinely hard, which is why minipdftoosz's Protect PDF and Remove Password tools do not reinvent it — they lean on qpdf, a mature, battle-tested, open-source PDF processing library that has handled PDF encryption correctly for years, compiled to WebAssembly so it can run directly inside a browser.
That compilation step matters a lot for what "runs locally" actually means here. WebAssembly (often shortened to Wasm) is a way of taking code originally written in a language like C++ and compiling it into a binary format that browsers can execute at speeds close to native code, without any server involved. qpdf-wasm is exactly that: the real qpdf encryption and decryption logic, compiled once, shipped as a static file bundled with this site, and executed entirely on your device every time you use one of these tools.
There is one more architectural detail worth knowing about: both tools run their qpdf-wasm workload inside a Web Worker, not on the browser's main thread. A Web Worker is a background thread the browser gives your JavaScript code, separate from the thread that handles your page's UI and rendering. Password operations on larger PDFs can take a noticeable moment of CPU time, and running that work in a worker keeps the tab's interface responsive instead of freezing while the encryption happens — a small but genuinely useful piece of engineering that has nothing to do with privacy and everything to do with not making you stare at a frozen tab.
The actual privacy story is simple once you know the pieces: your file is read locally, handed via message-passing to the worker running qpdf-wasm, encrypted or decrypted with the password you typed (which also never leaves the worker's memory), and the resulting bytes are handed back to trigger a local download. There is no server anywhere in this pipeline for your file or your password to pass through — which is not a marketing claim so much as a direct consequence of there being no server-side code in this project's deployment at all.
It is worth being candid about one practical limitation: because the encryption itself follows the real PDF specification, a password you set with Protect PDF genuinely restricts anyone who does not have it — including the file's original owner if they forget their own password. There is no "recovery" mechanism, because there is no server holding a copy of your file or password to recover from. Losing the password to a file protected this way means the file is, correctly and by design, unrecoverable without it — the same as it would be with any properly implemented PDF encryption tool.
Remove Password works the same way in reverse: given the correct existing password, qpdf-wasm decrypts the file locally and produces an unprotected copy. It cannot bypass a password it doesn't have — that would defeat the entire point of PDF encryption existing in the first place, and no browser-only tool, or any legitimate tool, should claim otherwise.