PDF Candy

What it does

PDF Candy is a large online toolbox of roughly ninety PDF utilities — converting between PDF and Office or image formats, merging, splitting, compressing, editing text, annotating, signing, protecting with passwords, watermarking and OCR — run from the browser on the vendor's servers. A separate Windows desktop application performs the same kinds of jobs offline. The free tier covers most tools with page, hourly and file-size limits and no batch processing.

Best for: People who need a fast, no-install conversion or editing job and do not mind uploading the file, plus Windows users who want the same toolkit offline.

Worth knowing: The browser tools upload your file to PDF Candy's servers, which the vendor says are deleted within two hours. Free use is capped by hourly and page limits, file-size limits and no batch processing. The 500 MB per-task figure is a paid-plan allowance rather than a free product-wide maximum, and batch processing is a paid capability while the free tier states it has none. The vendor's two-hour deletion statement is kept as reported, and the offline Windows edition is a distinction rather than a guarantee of tool parity with the web service, which would need an edition matrix. Whiteout is not permanent redaction. The regions statement needs a direct processing or storage source rather than an inference from a global service or the operator's address.

Details, and where each comes from

Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.

Versions covered

Web · Windows

Website

pdfcandy.com

Requires an account

No

Free tier

Yes

Watermark on the free tier

Not verified

Maximum file size

500 MB

Batch processing

Yes

Data residency

Multiple regions

Open source

Not verified

Self-hostable

Not verified

Licence

Not verified

Redaction

Covers it — content is not removed

Programmatic access

None

Last availability check

Responded in 295 ms 16 October 2026

Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.

What the vendor says

Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded — not that we tested the behaviour, unless the note says we did.

• “We are committed to protecting your privacy and keep your files on our servers for no longer than two hours, in full compliance with GDPR regulations.”

  Checked by us — the source says this Read 21 September 2026

  Confirmed verbatim on the homepage, and corroborated rather than merely repeated by the vendor's own policy — the second time in this campaign that a claim has been supported two ways, after pikepdf. Section 2.7 of the privacy policy states that uploaded files and generated output "are kept on our servers for as long as 2 hours", that "within 2 hours of the files being kept on our server, they will be permanently deleted", and, in the same paragraph, "We do not make any backups of the files uploaded and processed. We do not share or provide access to these files to third-party websites or persons." The policy names the operator as Icecream Apps Limited, Cyprus, and carries a data-controller statement plus the standard GDPR rights list at section 2.10. The claim's second half, "in full compliance with GDPR regulations", is a legal self-assessment and is the part nothing on either page establishes; the policy shows the machinery of compliance rather than evidence of it, and we cannot establish it. Worth stating that this claim is also the one in this tier that our instrument could genuinely test: a two-hour deletion promise is observable by uploading a fixture, holding the download URL and re-requesting it after the stated period, which nothing in this campaign has yet done.

  Standing: Re-read: the text is unchanged, but the page publishes values that move

  Check it yourself: the source, the SHA-256, and how we checked

  Read

  https://pdfcandy.com/

  From

  the text a browser renders

  SHA-256

  89a887eee7ba37b5c9282823d1f6af2db73074aec41919cc47e5fdac771f7fa3

  How we checked: pdfcandy.com rendered in headless Chrome with scripts/render-page.mjs on 2026-09-21 (DOM 98903 bytes, visible text 1541 bytes) carries the claim; sourceHash is the SHA-256 of that rendered homepage text. Because the sentence makes a specific retention promise and also asserts legal compliance, the linked privacy policy was read as a second source on the same day: https://pdfcandy.com/privacy-policy.html rendered to 18712 bytes of text, SHA-256 1d9ca8da7468380abb16e22dba7ba68cb1edaf9f3c8376439c46de734ff0d58c. The claim's source is the homepage and the verdict rests on it.

  What this hash proves, and what it does not

• “PDF Candy operates on ISO 27001-certified infrastructure from leading cloud providers and data centers, ensuring robust information security at every stage of document handling.”

  Checked by us — the source says this Read 22 September 2026

  Confirmed verbatim: "PDF Candy operates on ISO 27001-certified infrastructure from leading cloud providers and data centers, ensuring robust information security at every stage of document handling." The distinction the sentence makes is the one a reader should keep, and it is easy to lose: the ISO 27001 certification named here belongs to the infrastructure providers, not to PDF Candy. The sentence says "ISO 27001-certified infrastructure from leading cloud providers", and the section heading above it reads "ISO Certified Data Centers" — so what is certified is the data centre the files sit in, which is a genuine and checkable property of a cloud platform, and it is not the same as the company holding an ISO 27001 certificate for its own information security management system. The company behind the site is Icecream Apps Limited of Cyprus, established when reading the privacy policy for this tool's retention claim in an earlier batch. The same page adds that servers are based in the EU and USA, and states that vulnerability assessments and penetration testing are run regularly on the systems. No certification body or certificate identifier appears, and nothing here was independently verified.

  Standing: Re-read: the text is unchanged, but the page publishes values that move

  Check it yourself: the source, the SHA-256, and how we checked

  Read

  https://pdfcandy.com/security.html

  From

  the text a browser renders

  SHA-256

  8f6ed206454230ccc000e90b6619c8926dd483fc425b161c613a5b9eb9c0b6bf

  How we checked: Re-verified verbatim on 2026-09-22: https://pdfcandy.com/security.html re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-pdfcandy-com-security-html-22be5049.txt.

  What this hash proves, and what it does not

• “Whiteout PDF documents to hide specific text, images, or sections on the page.”

  Checked by us — the source says this Read 22 September 2026

  CONFIRMED covers_content, from the file rather than from the wording. The saved output carries a single new vector drawing — a pure white fill at rect (67.3, 82.0, 410.0, 108.0), which is exactly the canary band that was marked — and page one still yields the SAME 54 characters of extractable text as the input, CANARYREDACTME7F3A2B included. So the marked text is hidden by a white rectangle and remains fully recoverable from the file by any text extractor or copy-paste. The vendor is accurate here: the tool is called Whiteout and the page says "hide", not "remove". Scope: the web tool, one document, one date.

  Standing: Re-read: the text is unchanged, but the page publishes values that move

  Check it yourself: the source, the SHA-256, and how we checked

  Read

  https://pdfcandy.com/whiteout-pdf.html

  From

  the text a browser renders

  SHA-256

  c42cf1aa9c9f322df35e02a36aaab42726e671b70f43763e2b51103525f913d1

  How we checked: Re-verified verbatim on 2026-09-22: https://pdfcandy.com/whiteout-pdf.html re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-17. sourceHash is the SHA-256 of the re-rendered text, held as rv-pdfcandy-com-whiteout-pdf-html-f598faea.txt.

  What this hash proves, and what it does not

Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked — it is not a judgement about anyone.

Alternatives to PDF Candy

What to use instead of PDF Candy The tools in this index that do the same jobs, and what separates them.