On this page
Remove active content before rendering
Original pages
Text, vectors and images
Copy pages
Keep source objects intact
Merged PDF
New order, same page detail
Scripts, frames, plugins, inline event handlers and form actions are not required to create a static document and are removed. The converter does not wait for a webpage application to execute.
This makes results more deterministic, but dynamic content that only appears after JavaScript runs must be exported into static HTML first.
Block external and local resource loading
Remote stylesheets, web fonts, images and local file URLs can disclose network information or make output depend on changing resources. The secure renderer blocks them.
Embed essential images as data URLs and keep CSS self-contained. Do not embed sensitive resources unless they are intended to appear in the PDF.
- No remote CSS imports.
- No HTTP image fetches.
- No local-file access.
- No JavaScript execution.
Review removed-content consequences
A safe conversion can still be incomplete if the source depended on blocked resources. Preview the result and check logos, charts, icons, fonts and generated sections.
Treat the PDF as a new output artifact. Verify it before sharing and apply protection separately when access controls are required.
Put the workflow into practice
Arrange source documents, select the pages you need, and create one PDF locally in your browser. Review the result before choosing any optional next step.
Try HTML to PDFFrequently asked questions
Clear answers before you merge
Does the converter execute JavaScript?
No. Scripts and active event handlers are removed.
Why is a remote image missing?
Remote resource loading is blocked; embed essential images as data URLs.
Can I use external web fonts?
No. Use fonts available to the renderer and review any substitution.
Does sanitization make the PDF confidential?
No. Sanitization reduces rendering risk; use appropriate access controls for confidential output.
