HRConvert2

A self-hosted, drag-and-drop file conversion server.
No database. No cookies. No accounts. No tracking. Nothing leaves your server.

Installation Instructions · Documentation · Docker Image

Every free online file converter is a data collection business. You upload a contract, a medical scan, a CAD drawing of something you have not patented yet, and you have handed it to a stranger with an ad network.

HRConvert2 is the same convenience without the transaction. It runs on hardware you control, converts files locally, and deletes them on a timer you set. Users need no account and leave no trace. It will run on a Raspberry Pi.

• Nothing is transmitted anywhere. Conversions happen on your machine using local tools.
• No accounts, no sessions, no cookies, no database. A user is a temporary directory.
• No tracking of any kind. No analytics, no telemetry, no external fonts, no CDN.
• Files are deleted automatically once they pass the age threshold you configure.
• Every user gets isolated scratch space. Nobody can see anybody else's files.
• Drag, drop, convert, download. That is the entire workflow.

457 file formats across documents, spreadsheets, presentations, images, audio, video, streams, 3D models, CAD drawings, vector graphics, subtitles & archives.

• Every conversion runs inside its own operating system sandbox. Not just the risky ones.
• Optical Character Recognition on PDFs & images.
• OpenSCAD rendering, sandboxed, with multi-file assemblies supported.
• Live stream capture from .m3u8 playlists, with full SSRF inspection before any fetch.
• On-demand virus scanning with ClamAV or scanCore.
• Automatic background virus scanning of every upload, if you want it.
• Temporary share links that expire with the file.
• 26 languages, switchable by the user, built in. No language packs to install.
• 3 interfaces & 7 color schemes, switchable from within the page.
• Right-to-left layout support for Arabic, Hebrew, Persian, Urdu & Syriac.
• A command line interface for diagnostics, maintenance & self-updating.
• Self-updating from the command line, with automatic rollback if the update will not run.
• Installs cleanly alongside WordPress & other software on the same server.
• Every dependency version-checked at runtime, so a broken install says so instead of failing quietly.

HRConvert2 is designed for public-facing deployment, which means it is built to be attacked.

Every conversion dependency runs inside a bubblewrap namespace. ImageMagick, FFMPEG, Inkscape, Dia, Assimp, MeshLab, 7-Zip, Tesseract, pdftotext, OpenSCAD & every archive utility. Each conversion sees exactly two directories — the one holding its input, mounted read only, and the one receiving its output. Nothing else on the disk exists inside the namespace. The network is unshared, which closes every URL handler in every dependency at once. A server that cannot build a sandbox refuses the conversion rather than quietly running without one.

• Uploads are sanitized before any dependency touches them.
• OpenSCAD reads arbitrary files by design & cannot be given a sandbox through its own arguments, so the operating system provides one. Filtering the source is a convenience layer, not a boundary — four bypasses were reported against the line-oriented filter & a fifth against the stateful rewrite that replaced it. The sandbox is the boundary.
• Stream files are fully inspected before FFMPEG sees them. Every referenced host is resolved without following redirects, checked against private & reserved address ranges, and pinned by IP so no dependency can be redirected to your internal network.
• Session identifiers are derived from a per-install secret, generated with a CSPRNG at install time & never transmitted.
• Every dependency is version-pinned & the pin is verified at runtime, not at install time. php convertCore.php -v reports whether every one of them actually satisfies it.
• Updates are never reachable over HTTP. Replacing application code requires shell access, which is the correct authorization for the operation. An endpoint protected by a secret would reduce that to one guessable string.
• Errors are documented. Every numbered error has an entry explaining the cause & the fix in ERROR_DESCRIPTIONS.txt.

Security reports are welcome & are taken seriously. Several of the protections above exist because somebody took the time to find & report a real flaw.

HRConvert2 answers to the command line as well as to a browser. The two are mutually exclusive — an argument supplied on the command line disables the web interface entirely for that invocation, creates no session & touches no user data.

php convertCore.php -v          Report every component version & every dependency.
php convertCore.php -h          Display help & point at the relevant documentation.
php convertCore.php -c          Sweep expired sessions from both data locations.
php convertCore.php -c=now      Sweep every session regardless of age.
php convertCore.php -u          Update the application from the configured source.
php convertCore.php -u=v3.6.7   Update to exactly that release.

-v is the useful one. It is not an echo of a version number — it runs every dependency check the converters run, enumerates every installed interface & language pack, & reports which of them actually work. One command answers will this install convert anything, which is a different question from what is configured.

-u downloads a release, merges your existing configuration into the new one, swaps the installation atomically, then asks the new core to report its own version. An installation that cannot answer is rolled back automatically & the previous version is preserved.

Full details in USING_COMMAND_LINE.txt.

Debian or Ubuntu Linux, Apache 2.4 & PHP 8 or later. Everything else is a package install.

A Raspberry Pi Model B+ is enough to run it. Anything x86 or x64 will be comfortable.

Bubblewrap is required. Debian 12 & Ubuntu 24.04 restrict unprivileged user namespaces by default, so a fresh installation needs an AppArmor profile before conversions will run. The Installation Instructions cover it. A Docker image is also available & has its own sandbox considerations, documented on Docker Hub.

Users switch languages from the interface, or you can force one in config.php, or pass it in the URL with ?language=de. Every translation ships with the application.

Adding a language means adding one folder. The application is built so that communities can translate it for themselves without touching a single line of application code.

Three interfaces ship with the application: Default, Wide & Original. Seven color schemes: red, green, blue, grey, orange, purple & dark.

Users pick their own from a selector inside the page — language by flag, colour by swatch, interface by name. Administrators can lock any of it down in config.php. Every interface lives in its own folder under /UI & can be forked without touching the core, so a deployment can carry its own branding.

Interfaces & language packs are version-checked against the core. One that does not match is not loaded, & the default is used instead rather than rendering a broken page.

More screenshots are in Documentation/Screenshots.

Translations, interface themes & bug reports are all welcome. The application is deliberately modular: a language is a folder, an interface is a folder, & neither requires touching the core.

If you find a security issue, please open an issue. Reports that include a reproduction are worth their weight & have directly shaped this project.

GNU General Public License v3.0.

Free to use, free to modify, free to self-host. If you improve it, send it back.