Skip to content
dialegein

Apache PDFBox

Long-standing Apache Java library and CLI suite for creating and manipulating PDFs.

Jobs Merge Protect Edit Convert Extract View Sign Compress

Since 2002

Visit Apache PDFBox

Opens the vendor's own site.

Jobs covered

Open a task to see exactly what the vendor documentation supports.

Merge Browse all merge tools

merging a list of PDF documents into a new document with the PDFMerger command line tool in PDFBox, taking two or more source PDF files and a target PDF file

Protect Browse all protect tools

encrypting PDFs with the PDFBox Encrypt command line tool using owner and user passwords or an X.509 certificate file, with permission settings for assembling, extracting content, filling in forms, modifying, annotating, printing and printing degraded, and key lengths of 40, 128 or 256 bits, and decrypting PDFs with the Decrypt tool using the owner password or a certificate keystore

Edit Browse all edit tools

manipulating existing PDF documents in the Java library

Convert Browse all convert tools

creating PDFs from scratch with embedded fonts and images, and rendering PDFs to images such as PNG or JPEG

Extract Browse all extract tools

extracting all text from a PDF with the ExtractText command line tool in PDFBox, writing raw text, HTML or Markdown, with encoding, page range, console output and sort options

View Browse all view tools

rendering each page of a PDF to an image file with the PDFToImage command line tool in PDFBox, writing JPG or PNG at a selectable DPI and colour depth, with page range and crop box options

Sign Browse all sign tools

adding a digital signature to a PDF with the PDFBox signature API, using a PDSignature dictionary with the Adobe PPKLite filter and the adbe.pkcs7.detached subfilter, a keystore, and an incremental save, as shown in the project's CreateSignature and CreateVisibleSignature examples

Compress Browse all compress tools

compressed saving of documents by default, overridable per save; not a standalone PDF optimiser

Where your files are processed

No server involved

A Java class library plus local Java applications. Parsing, rendering, encryption and signing all run in the local JVM. That is a property of the library itself: what an application built with it does with your file depends on that application, not on this.

Architectural: a Java class library and a set of local Java applications. Parsing, rendering, encryption and signing all run in the local JVM with no hosted service involved.

What it does

A Java library plus a set of command-line utilities under the Apache Software Foundation. It creates PDFs from scratch, text or images, extracts Unicode text, fills and reads form data, merges, splits, overlays and renders pages to images, encrypts and decrypts with password or certificate security, digitally signs documents, and can preflight against PDF/A.

Lower-level APIs give access to the object model and content stream operators when the high-level classes are not enough.

Best for

JVM shops that need a permissively licensed PDF toolkit with both a library and ready-made command-line tools.

Worth knowing

No redaction at all - the feature request is still open and unresolved, and the shipped command-line tools have no redact or content-removal command. The library is also far more capable than the CLI: signing and preflight are library-only.

Details, and where each comes from

Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.

Versions covered
Windows · macOS · Linux · Self-hosted
Website
pdfbox.apache.org
Requires an account
Not applicable
Watermark on the free tier
Not verified
Maximum file size
Not verified
Batch processing
Yes
Data residency
Self-hosted
Open source
Yes
Self-hostable
Yes
Licence
Apache-2.0
Redaction
No redaction feature
Programmatic access
Embeddable library · Command line
Last availability check
Responded in 193 ms 21 October 2026

Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.

What the redaction verdict rests on

From the vendor's own documentation, read 22 September 2026. Not tested by us.

What that does not establish

The vendor’s own site was read on 22 September 2026 and contains no mention of redaction, sanitisation, blackout or whiteout. Absence from a vendor’s own material is not proof that a feature does not exist - it may be undocumented, or on a page the reading did not reach - but for a NEGATIVE claim it is the strongest evidence available, and it is weaker than a positive quote.

Recorded as such rather than presented as certainty.

https://pdfbox.apache.org

What the vendor says

Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded - not that we tested the behaviour, unless the note says we did.

  • “The Apache PDFBox® library is an open source Java tool for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command-line utilities. Apache PDFBox is published under the Apache License v2.0.”

    Checked by us - the source says this Read 22 September 2026

    Confirmed verbatim: the whole claim is one paragraph of the project's own description, unaltered, including the Apache License v2.0 sentence. The site footer corroborates the licence independently of the description, reading "Licensed under the Apache License, Version 2.0" with the Apache Software Foundation copyright.

    Recorded as the project's own description; the licence itself is a file in the repository rather than something asserted on a page, and we did not read the LICENSE file for this entry.

    Standing: Re-read and matched byte for byte

    Check it yourself: the source, the SHA-256, and how we checked
    Read
    https://pdfbox.apache.org/
    From
    the text a browser renders
    SHA-256
    fb2fb71deb172af5217b115c32ade7f1dcbb23f09427d354b8dbec4b5e7f62f8

    How we checked

    Re-verified verbatim on 2026-09-22: https://pdfbox.apache.org/ re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-pdfbox-apache-org-4dcefa23.txt.

    What this hash proves, and what it does not

Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked - it is not a judgement about anyone.

Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.

Visit Apache PDFBox Report a problem

Related reading

How this record was put together

Editorial review.
No editor has signed this record off. That is not the same as nothing having been checked, and the lines below say what has.
Source reading.
1 claim taken from the vendor's own pages, read between 22 September 2026 and 22 September 2026.
Website availability.
The vendor's site was last checked on 21 October 2026.
Behaviour testing.
We ran this ourselves. The file handling was watched directly.

Sources: pdfbox.apache.org (home, 3.0 command-line documentation); the repository LICENSE and README; the Apache JIRA issue tracker; the RemoveAllText example source; GitHub API metadata.