Skip to content
dialegein

mPDF

PHP library that generates PDFs from UTF-8 HTML, and whose manual calls it dated.

Jobs Convert

Where your files are processed

No server involved

A PHP library running in your own web server's process. No service, no account, no network call — the HTML and the data behind it stay on your infrastructure. That is a property of the library itself: what an application built with it does with your file depends on that application, not on this.

A PHP library that runs in your own web server's process. There is no service, no account and no network call, so the HTML and the data behind it stay on your infrastructure.

What it does

mPDF is a PHP library that takes UTF-8 HTML and produces a PDF, which for a long time made it the way a PHP application produced invoices, statements and reports without leaving the language. It handles CJK and right-to-left scripts, headers and footers, page numbering, tables of contents and barcodes — the features that a browser's print dialog does not give you. It began as a fork of FPDF and HTML2FPDF and has been maintained for years since, though the project's own manual is unusually candid about where it now stands.

Best for: Existing PHP applications that already generate documents with it, and teams who cannot leave PHP. The manual's own advice is the honest summary: use it if a non-PHP approach is not available, or if you specifically want its colour handling, pre-print features, barcodes, headers and footers, page numbering or tables of contents.

Worth knowing: Its own manual says it is dated and points elsewhere, which is rare enough to be worth quoting rather than summarising: it describes mPDF as "quite dated software", notes that better alternatives exist, and suggests headless Chrome for state-of-the-art CSS support. CSS support is effectively frozen — the project says it will keep updating internal capabilities and PHP compatibility but that "better and/or newer CSS support will most likely not be implemented" — so a modern stylesheet is likely to need rewriting. The licence is GPL-2.0, which is copyleft: for a closed-source PHP application that is a real constraint and not a formality. And there is a security instruction that belongs in front of anyone building a form on it: the manual states that mPDF is not meant to receive HTML or CSS from an outside user and that user input must be sanitised above browser-level sanitisation, which is the opposite of what a template feature invites you to do.

Details, and where each comes from

Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.

Versions covered
Self-hosted
Website
mpdf.github.io
Requires an account
Not applicable
Watermark on the free tier
Not verified
Maximum file size
Not verified
Batch processing
Yes
Data residency
Self-hosted
Open source
Yes
Self-hostable
Yes
Licence
GPL-2.0
Redaction
No redaction feature
Programmatic access
Embeddable library
Last availability check
Responded in 104 ms 16 October 2026

Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.

What the redaction verdict rests on

From the vendor's own documentation, read 22 September 2026. Not tested by us.

What that does not establish: Recorded as `none` on absence and for the structural reason that applies to every generator in this index: mPDF builds a PDF from HTML and never opens one, so there is no document for a redaction feature to act on. What it does not establish: that a PDF produced with mPDF is safe to share. The manual's security instruction points the other way — the library will faithfully render whatever the template is given, which is how a field that should have been excluded ends up in a document the customer keeps.

https://mpdf.github.io/

What the vendor says

Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded — not that we tested the behaviour, unless the note says we did.

  • “mPDF as a whole is a quite dated software. Nowadays, better alternatives are available, albeit not written in PHP.”

    Checked by us — the source says this Read 1 October 2026

    Confirmed. The quoted text appears in the rendered page as read on 2026-10-01. This claim was carried as reported rather than checked until this read.

    Standing: Not re-read against the live source

    Check it yourself: the source, the SHA-256, and how we checked
    Read
    https://mpdf.github.io/
    From
    the text a browser renders
    SHA-256
    c8914bf67abad1a7267e92560e1f4ed73e837cdb01e3858e0251b343fe2bd911

    How we checked: Read as rendered text in headless Chrome on 2026-10-01 and saved to the evidence archive, so the read can be repeated against the same file. Comparison ignores case, punctuation and hyphenation, which is why "open-source" on the record matches "open source" on the page.

    What this hash proves, and what it does not

  • “mPDF is not meant to receive HMTL/CSS from an outside user. All user input passed to mPDF should be vetted and sanitized properly above the level of standard browser-level sanitization (such is htmlspecialchars).”

    Checked by us — the source says this Read 1 October 2026

    Confirmed. The quoted text appears in the rendered page as read on 2026-10-01. This claim was carried as reported rather than checked until this read.

    Standing: Not re-read against the live source

    Check it yourself: the source, the SHA-256, and how we checked
    Read
    https://mpdf.github.io/
    From
    the text a browser renders
    SHA-256
    c8914bf67abad1a7267e92560e1f4ed73e837cdb01e3858e0251b343fe2bd911

    How we checked: Read as rendered text in headless Chrome on 2026-10-01 and saved to the evidence archive, so the read can be repeated against the same file. Comparison ignores case, punctuation and hyphenation, which is why "open-source" on the record matches "open source" on the page.

    What this hash proves, and what it does not

Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked — it is not a judgement about anyone.

Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.

Visit mPDF Report a problem

Related reading

How this record was put together

Editorial review.
No editor has signed this record off. That is not the same as nothing having been checked, and the lines below say what has.
Source reading.
2 claims taken from the vendor's own pages, read between 1 October 2026 and 1 October 2026.
Website availability.
The vendor's site was last checked on 16 October 2026.
Behaviour testing.
We ran this ourselves. The file handling was watched directly.

Sources: mpdf.github.io, the project's manual, read 2026-09-22 with headless Chrome; the licence from the project's LICENSE.txt in its repository. Project documentation, not independently tested; the library was not installed and no document was generated.