Skip to content
dialegein

Apache PDFBox

Long-standing Apache Java library and CLI suite for creating and manipulating PDFs.

Jobs Merge Protect Edit Convert Extract View Sign Compress

Since 2002

Where your files are processed

No server involved

A Java class library plus local Java applications. Parsing, rendering, encryption and signing all run in the local JVM. That is a property of the library itself: what an application built with it does with your file depends on that application, not on this.

Architectural: a Java class library and a set of local Java applications. Parsing, rendering, encryption and signing all run in the local JVM with no hosted service involved.

What it does

A Java library plus a set of command-line utilities under the Apache Software Foundation. It creates PDFs from scratch, text or images, extracts Unicode text, fills and reads form data, merges, splits, overlays and renders pages to images, encrypts and decrypts with password or certificate security, digitally signs documents, and can preflight against PDF/A. Lower-level APIs give access to the object model and content stream operators when the high-level classes are not enough.

Best for: JVM shops that need a permissively licensed PDF toolkit with both a library and ready-made command-line tools.

Worth knowing: No redaction at all — the feature request is still open and unresolved, and the shipped command-line tools have no redact or content-removal command. The library is also far more capable than the CLI: signing and preflight are library-only.

Details, and where each comes from

Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.

Versions covered
Windows · macOS · Linux · Self-hosted
Website
pdfbox.apache.org
Requires an account
Not applicable
Watermark on the free tier
Not verified
Maximum file size
Not verified
Batch processing
Yes
Data residency
Self-hosted
Open source
Yes
Self-hostable
Yes
Licence
Apache-2.0
Redaction
No redaction feature
Programmatic access
Embeddable library · Command line
Last availability check
Responded in 36 ms 16 October 2026

Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.

What the redaction verdict rests on

From the vendor's own documentation, read 22 September 2026. Not tested by us.

What that does not establish: The vendor’s own site was read on 22 September 2026 and contains no mention of redaction, sanitisation, blackout or whiteout. Absence from a vendor’s own material is not proof that a feature does not exist — it may be undocumented, or on a page the reading did not reach — but for a NEGATIVE claim it is the strongest evidence available, and it is weaker than a positive quote. Recorded as such rather than presented as certainty.

https://pdfbox.apache.org

What the vendor says

Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded — not that we tested the behaviour, unless the note says we did.

  • “The Apache PDFBox® library is an open source Java tool for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command-line utilities. Apache PDFBox is published under the Apache License v2.0.”

    Checked by us — the source says this Read 22 September 2026

    Confirmed verbatim: the whole claim is one paragraph of the project's own description, unaltered, including the Apache License v2.0 sentence. The site footer corroborates the licence independently of the description, reading "Licensed under the Apache License, Version 2.0" with the Apache Software Foundation copyright. Recorded as the project's own description; the licence itself is a file in the repository rather than something asserted on a page, and we did not read the LICENSE file for this entry.

    Standing: Re-read and matched byte for byte

    Check it yourself: the source, the SHA-256, and how we checked
    Read
    https://pdfbox.apache.org/
    From
    the text a browser renders
    SHA-256
    fb2fb71deb172af5217b115c32ade7f1dcbb23f09427d354b8dbec4b5e7f62f8

    How we checked: Re-verified verbatim on 2026-09-22: https://pdfbox.apache.org/ re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-pdfbox-apache-org-4dcefa23.txt.

    What this hash proves, and what it does not

Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked — it is not a judgement about anyone.

Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.

Visit Apache PDFBox Report a problem

Related reading

How this record was put together

Editorial review.
No editor has signed this record off. That is not the same as nothing having been checked, and the lines below say what has.
Source reading.
1 claim taken from the vendor's own pages, read between 22 September 2026 and 22 September 2026.
Website availability.
The vendor's site was last checked on 16 October 2026.
Behaviour testing.
We ran this ourselves. The file handling was watched directly.

Sources: pdfbox.apache.org (home, 3.0 command-line documentation); the repository LICENSE and README; the Apache JIRA issue tracker; the RemoveAllText example source; GitHub API metadata.