mPDF
PHP library that generates PDFs from UTF-8 HTML, and whose manual calls it dated.
Jobs Convert
Opens the vendor's own site.
Jobs covered
Open a task to see exactly what the vendor documentation supports.
Where your files are processed
No server involved
A PHP library running in your own web server's process. No service, no account, no network call - the HTML and the data behind it stay on your infrastructure. That is a property of the library itself: what an application built with it does with your file depends on that application, not on this.
A PHP library that runs in the caller's own PHP server process. The mPDF project publishes no hosted service or account; HTML and caller-supplied data are processed by the application's own PHP environment.
Network I/O is controlled by the caller, so local processing is architectural rather than an absolute no-network guarantee.
What it does
mPDF is a community-maintained PHP library, currently at 8.3.1 (Packagist, 11 March 2026), that takes UTF-8 HTML and produces a PDF, which made it a common way for PHP applications to produce invoices, statements and reports without leaving the language. It handles CJK and right-to-left scripts, headers and footers, page numbering, tables of contents and barcodes - features a general-purpose renderer's print dialog does not give you.
It began as a fork of FPDF and HTML2FPDF and has been maintained for years, though the project's own manual is unusually candid about its dated CSS engine. It requires PHP ^5.6/^7/~8.0-8.5, ext-gd and ext-mbstring, and is GPL-2.0-only; it is a library only, not a hosted service.
Best for
Existing PHP applications that already generate documents with it, and teams who cannot leave PHP. The manual's own advice is the honest summary: use it if a non-PHP approach is not available, or if you specifically want its colour handling, pre-print features, barcodes, headers and footers, page numbering or tables of contents.
Worth knowing
Its own manual says it is dated and points elsewhere, which is rare enough to be worth quoting rather than summarising: it describes mPDF as 'quite dated software', notes that better alternatives exist, and suggests a headless Chromium renderer for state-of-the-art CSS support. CSS support is effectively frozen - the project says it will keep updating internal capabilities and PHP compatibility but that better and/or newer CSS support will most likely not be implemented - so a modern stylesheet is likely to need rewriting.
The licence is GPL-2.0-only, which is copyleft: for a closed-source PHP application that is a real constraint and not a formality. And there is a security instruction that belongs in front of anyone building a form on it: the manual states that mPDF is not meant to receive HTML or CSS from an outside user and that user input must be sanitised above ordinary HTML escaping, which is the opposite of what a template feature invites you to do.
The library is self-hosted PHP only; there is no hosted mPDF edition, account or vendor service.
Details, and where each comes from
Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.
- Versions covered
- Self-hosted
- Website
- mpdf.github.io
- Requires an account
- Not applicable
- Watermark on the free tier
- Not verified
- Maximum file size
- Not verified
- Batch processing
- Yes
- Data residency
- Self-hosted
- Open source
- Yes
- Self-hostable
- Yes
- Licence
-
GPL-2.0-only.
GPL-2.0-only. Packagist metadata for 8.3.1 declares GPL-2.0-only and requires PHP ^5.6 || ^7.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0, ext-gd, ext-mbstring and its PHP package dependencies.
The project is community-maintained; the README credits Ian Back as the original author, and no company is documented. Copyleft terms matter for closed-source applications; no permission to use a later GPL version was established.
- Redaction
- No redaction feature
- Programmatic access
- Embeddable library
- Last availability check
- Responded in 115 ms 21 October 2026
Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.
What the redaction verdict rests on
From the vendor's own documentation, read 22 September 2026. Not tested by us.
What that does not establish
Recorded as `none` on absence and for the structural reason that applies to every generator in this index: mPDF builds a PDF from HTML and never opens one, so there is no document for a redaction feature to act on. What it does not establish: that a PDF produced with mPDF is safe to share.
The manual's security instruction points the other way - the library will faithfully render whatever the template is given, which is how a field that should have been excluded ends up in a document the customer keeps.
What the vendor says
Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded - not that we tested the behaviour, unless the note says we did.
-
“mPDF as a whole is a quite dated software. Nowadays, better alternatives are available, albeit not written in PHP.”
Checked by us - the source says this Read 1 October 2026
Confirmed. The quoted text appears in the rendered page as read on 2026-10-01.
This claim was carried as reported rather than checked until this read.
Standing: Not re-read against the live source
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- c8914bf67abad1a7267e92560e1f4ed73e837cdb01e3858e0251b343fe2bd911
How we checked
Read as rendered text in headless Chrome on 2026-10-01 and saved to the evidence archive, so the read can be repeated against the same file. Comparison ignores case, punctuation and hyphenation, which is why "open-source" on the record matches "open source" on the page.
-
“mPDF is not meant to receive HMTL/CSS from an outside user. All user input passed to mPDF should be vetted and sanitized properly above the level of standard browser-level sanitization (such is htmlspecialchars).”
Checked by us - the source says this Read 1 October 2026
Confirmed. The quoted text appears in the rendered page as read on 2026-10-01.
This claim was carried as reported rather than checked until this read.
Standing: Not re-read against the live source
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- c8914bf67abad1a7267e92560e1f4ed73e837cdb01e3858e0251b343fe2bd911
How we checked
Read as rendered text in headless Chrome on 2026-10-01 and saved to the evidence archive, so the read can be repeated against the same file. Comparison ignores case, punctuation and hyphenation, which is why "open-source" on the record matches "open source" on the page.
Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked - it is not a judgement about anyone.
Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.
Related reading
- Which PDF tools keep your file on your machine - what we count as processing on your own device.
- Open source PDF tools, and what their licences require - what open source does and does not tell you.