PDF Viewer

Opens a PDF shared in a Matrix room and renders it in place, so the document and the conversation about it stay on screen together. Pages are rasterised with PDF.js — a PDF can carry JavaScript, a canvas cannot, so nothing in the document ever executes.

Pinned in a room it lists the PDFs shared there, newest first, and opens the one you pick. You can draw on a document, add a drawn signature, and send the result back to the room as a new attachment — the original stays where it is. A signature here is a picture of a signature: it is placed into the page itself so every reader sees it, but it carries no certificate and proves nothing cryptographically.

It reads end-to-end encrypted attachments, which no other widget does. A widget asking the client for room media over MSC4039 gets back whatever the media repository serves, and in an encrypted room that is ciphertext it has no key for. Instead of asking clients to decrypt on a widget's behalf, the host passes the event's EncryptedFile object — key, IV and SHA-256 — in the URL fragment, which browsers never send to the server hosting the widget. The widget verifies the hash, then decrypts with WebCrypto AES-CTR itself.

Opened that way — one document handed over by a host — it learns exactly one file key for one attachment, never a room key. Pinned as a room widget it needs more: listing the room's PDFs means reading its file messages, and in an encrypted room those carry the key of every PDF in the list, opened or not. That is the price of the list, and the permissions below say so. Permission to write is asked for separately, at the moment you press Save. No change to the Matrix client is needed for any of this.

Zoom, fit-to-width, lazy page rendering, light and dark themes, and password-protected PDFs. CMaps and standard fonts are built in, so it works in air-gapped deployments with no CDN.

The origin serving this widget sees the documents you open in it. That is a smaller trust boundary than a client-side plugin with full DOM access, but it is not nothing — host it yourself, and never on the same origin as your Matrix client, or the iframe sandbox stops meaning anything.