EasyConvert

A client-side PDF to Excel/CSV converter built with vanilla JavaScript. It specializes in extracting tables from PDF documents, processes everything locally in the browser, and supports right-to-left (Hebrew and Arabic) text.

A project by NX1X Lab.

This is a small personal project, maintained on an as-needed basis. It is not accepting external contributions or feature requests.

EasyConvert reads a PDF entirely in the browser using PDF.js, detects tabular data, and exports it as an .xlsx (via SheetJS) or .csv file. No file ever leaves the device: there is no server, no upload, and no data collection. It is deployed as a static site on Vercel and installable as a Progressive Web App.

• Client-side processing - files are never uploaded to a server
• Table-focused extraction with multiple detection methods
• Excel (.xlsx) and CSV export
• Right-to-left support for Hebrew and Arabic
• Bilingual interface (English and Hebrew)
• Installable PWA with offline caching
• No signup, no file-size limit, no tracking of file content

EasyConvert/
├── public/                 # The deployable site (Vercel output directory)
│   ├── index.html          # Markup
│   ├── style.css           # Styles
│   ├── app.js              # Application logic
│   ├── sw.js               # Service worker
│   ├── manifest.json       # PWA manifest
│   ├── vendor/             # Self-hosted PDF.js and SheetJS
│   └── *.svg / *.png / *.ico
├── vercel.json              # Response headers, caching
├── .github/
│   ├── renovate.json       # Dependency automation
│   └── workflows/          # CodeQL, Gitleaks, dependency review, CI
├── scripts/                # Version + release helpers, vendored-file check
├── package.json
├── CHANGELOG.md
└── LICENSE

• Content Security Policy with no 'unsafe-inline' and no third-party origins at all (all JS and CSS are same-origin files, no inline handlers).
• PDF.js and SheetJS are self-hosted, not loaded from a CDN, so there is no third-party script origin in the trust chain.
• Strict response headers: HSTS (preload), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy.
• Spreadsheet formula-injection guard on CSV and XLSX export.
• Supply chain: committed lockfile, GitHub Actions pinned to commit SHAs, Renovate with a 14-day release cooldown, and CI that scans for secrets (Gitleaks), reviews dependencies, runs CodeQL, and verifies the vendored libraries are present and consistently referenced.

The site is static; serve the public/ directory with any static file server:

# Python
python -m http.server 8000 -d public

# Node
npx serve public

Then open http://localhost:8000.

The repository is deployed as a static site. To serve only the site directory and keep the rest of the repository private, the output directory is set to public.

1. In the Vercel dashboard, create a project and connect this repository.
2. Build settings:
   • Framework preset: Other
   • Build command: (leave empty)
   • Output directory: public
   • Root directory: /
3. Deploy. Only the contents of public/ are published; everything else in the repository (docs, CI config, package files) is never served.

vercel.json applies the security headers and caching rules. No environment variables are required.

1. Upload a PDF (drag and drop, or click to browse).
2. Choose an extraction method and options.
3. Review the extracted data in the preview table.
4. Download as Excel or CSV.

Extraction methods: Smart Table Detection, Text Extraction, Structured Data, and Advanced Table Detection.

This project follows Semantic Versioning. See CHANGELOG.md for release notes.

• PDF.js - PDF parsing
• SheetJS - spreadsheet generation
• Vercel - hosting

Licensed under the Apache License 2.0. See LICENSE for details.