PDF Candy
Browser PDF toolkit with 90+ tools, plus an offline Windows desktop app.
Operated by Icecream Apps Limited
Opens the vendor's own site.
Jobs covered
Open a task to see exactly what the vendor documentation supports.
Convert
Browse all convert toolsconverting documents with PDF Candy, where the PDF converter page documents converting to and from PDF across more than twenty formats including images JPEG and TIFF, eBooks EPUB, MOBI, FB2, CBR and CBZ, and documents DOC, DOCX, PPT, XLS and ODT, with files processed on the vendor's servers and deleted within two hours; the site also lists individual directions such as PDF to Word, PDF to DOCX, PDF to Excel, PDF to PowerPoint, PDF to image, PDF to TIFF, PDF to ODT, PDF to PDF/A, PDF to SVG, PDF to CSV, PDF to RTF, PDF to MOBI, PDF to GIF and PDF to BMP, and conversion to PDF from Word, JPG, PNG, EPUB, DOCX, Excel, image, PowerPoint, PPTX, HEIC, HTML, DjVu, PAGES, TIFF, TXT, ODT, SVG, CSV, RTF, MOBI, DWG, PUB, XPS, XML, WebP, HEIF and JFIF; the scope makes no fidelity guarantee and claims no format beyond those listed
Edit
Browse all edit toolsediting PDFs with PDF Candy, where the Edit PDF page documents editing text, adding images, highlighting, reordering or inserting pages, annotating and signing, and says no watermark is added; the Edit PDF text page documents adding, deleting, formatting and changing text, says most standard fonts are recognised so style and size can be adjusted, warns that larger edits may shift nearby content, and says scanned papers are handled with OCR; the scope records text and object editing and formatting, leaves scanned-page text recognition to the OCR job, and makes no layout-stability guarantee
Compress
Browse all compress toolscompressing PDFs with PDF Candy, where the Compress PDF page documents two compression modes, Maximum for the smallest output and Recommended for a balance between compactness and quality, and says the compressor keeps text readable and images decent while reducing size, with files deleted within two hours; the scope records the two documented modes, makes no lossless guarantee and claims no specific size-reduction percentage
Merge
Browse all merge toolsmerging PDFs with PDF Candy, where the Merge PDF page documents joining several PDF documents, arranging them in any order, including images and reordering pages, with no watermarks and no hidden fees, and says uploads are deleted within two hours; the scope records the combine, order and page operations, with no claim about preserving signatures, forms or annotations across a merge
OCR
Browse all ocr toolsrunning OCR with PDF Candy, where the PDF OCR page documents recognising text in scanned PDFs to create editable and searchable output, says the tool processes all pages in a single file and preserves the original order, and warns that extremely blurry text may need manual correction; the page does not document a language list, a language count or an accuracy figure, so the scope records the scanned-to-editable-text workflow without a language or accuracy claim
Protect
Browse all protect toolsprotecting PDFs with PDF Candy, where the Protect PDF page documents encrypting a PDF with a password so it cannot be opened without the password, and says the encryption mainly restricts opening the file and that locking printing, copying or editing requires the separate permission restriction; the page also documents download, Google Drive or Dropbox output and a share link valid for seven days, with files otherwise deleted within two hours; the scope records the password-protection and permission-restriction workflow and makes no specific encryption-algorithm claim, with the separate Whiteout tool kept out of redaction
Sign
Browse all sign toolssigning PDFs with PDF Candy, where the Sign PDF page documents placing a custom signature as text, a freehand drawing or an image, previewing the pages and applying as many signatures as needed anywhere in the document, and then downloading, sending to Google Drive or Dropbox or generating a share link; the page calls this an electronic signature and the site does not document a certificate-based digital signature, certificate validation or timestamping, so the scope is the electronic signature workflow only and makes no legal-validity or certificate-based guarantee
Where your files are processed
Mixed - depends on version and feature
The vendor's own documentation separates them. On the device: Windows. On their servers: Web. A single answer for the whole product would be wrong for one of them.
The web tools process files on PDF Candy's servers, which the vendor says are deleted within two hours. The separate Windows desktop app is the opposite: the vendor's FAQ says it operates entirely offline with all processing on your PC.
What it does
PDF Candy is a large online toolbox of more than ninety PDF utilities (the About page says 98 tools) - converting between PDF and Office or image formats, merging, splitting, compressing, editing text, annotating, signing, protecting with passwords, watermarking and OCR - run from the browser on the vendor's servers. A separate Windows desktop application, PDF Candy Desktop 3.20, bundles 35+ tools and works offline.
The free tier covers most tools with page, hourly and file-size limits, no batch processing and a desktop operations limit.
Best for
People who need a fast, no-install conversion or editing job and do not mind uploading the file, plus Windows users who want the same toolkit offline.
Worth knowing
The browser tools upload the file to PDF Candy's servers, which the vendor says are deleted within two hours, with no backups; a share link is available for seven days. Free use is capped by page and hourly limits, a limited file size, no batch processing and a desktop operations limit, while the 500 MB per-task figure, no hourly limits and priority processing are paid allowances rather than product-wide free maximums.
The recorded GBP 4 per month is the displayed monthly equivalent of the Desktop + Web Yearly plan, which is billed annually against a listed GBP 18 per month; Web Monthly is GBP 6 per month and the Desktop + Web Lifetime plan is GBP 99 one-off, so a monthly-billing reader should not take GBP 4 as the monthly price. The offline Windows edition is a distinction rather than a guarantee of tool parity with the web service: the desktop app is PDF Candy Desktop 3.20 with 35+ tools, while the web service advertises more than ninety and the About page says 98.
Whiteout is not permanent redaction; our own test of the whiteout tool left the canary text in the PDF text layer under a white rectangle, and the vendor describes whiteout as hiding content. The signing tool adds a text, freehand or image signature and does not document a certificate-based digital signature.
The OCR page documents scanned-page recognition without a language list or count and without an accuracy figure. The regions statement is supported by the security page's EU and USA server statement, and the operator address in Cyprus is not used as evidence of processing location.
Details, and where each comes from
Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.
- Versions covered
- Web · Windows
- Website
- pdfcandy.com
- Requires an account
- No
- Free tier
- Yes
- Watermark on the free tier
- Not verified
- Maximum file size
- 500 MB
- Batch processing
- Yes
- Data residency
- Multiple regions
- Open source
- Not verified
- Self-hostable
- Not verified
- Licence
-
Proprietary.
Proprietary. PDF Candy is operated by Icecream Apps Limited, Cyprus, which the privacy policy names as the data controller, with a policy effective 22 July 2025.
The plans are the Forever Free plan at 0, Web Monthly at GBP 6 per month, Desktop + Web Yearly at GBP 4 per month billed annually against a listed GBP 18 per month, and Desktop + Web Lifetime at GBP 99 as a one-time payment. The free plan has page and hourly restrictions, no batch processing, a limited file size and a desktop operations limit, while paid plans remove the hourly limits, raise the per-task file size to 500 MB and add priority processing.
Payments are processed by Paddle, and the vendor offers a 30-day refund where recurring errors cannot be resolved. Uploaded files and outputs are kept for no more than two hours and permanently deleted, with no backups.
- Redaction
- Covers it - content is not removed
- Programmatic access
- None
- Last availability check
- Responded in 71 ms 21 October 2026
Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.
What the redaction verdict rests on
Tested by us on 16 October 2026, on our own canary document rather than read off a product page.
“Whiteout PDF documents to hide specific text, images, or sections on the page.”
What that does not establish
This is a saved-output observation rather than a reading of the tool copy: the saved file gained a white filled rectangle over the marked band while the canary text remained in the text layer, unchanged. The vendor describes the tool as hiding content and does not claim permanent removal, so covering rather than redaction is the honest label.
The separate protect tool is password encryption, not redaction.
What the vendor says
Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded - not that we tested the behaviour, unless the note says we did.
-
“We are committed to protecting your privacy and keep your files on our servers for no longer than two hours, in full compliance with GDPR regulations.”
Checked by us - the source says this Read 21 September 2026
Confirmed verbatim on the homepage, and corroborated rather than merely repeated by the vendor's own policy - the second time in this campaign that a claim has been supported two ways, after pikepdf. Section 2.7 of the privacy policy states that uploaded files and generated output "are kept on our servers for as long as 2 hours", that "within 2 hours of the files being kept on our server, they will be permanently deleted", and, in the same paragraph, "We do not make any backups of the files uploaded and processed.
We do not share or provide access to these files to third-party websites or persons." The policy names the operator as Icecream Apps Limited, Cyprus, and carries a data-controller statement plus the standard GDPR rights list at section 2.10. The claim's second half, "in full compliance with GDPR regulations", is a legal self-assessment and is the part nothing on either page establishes; the policy shows the machinery of compliance rather than evidence of it, and we cannot establish it.
Worth stating that this claim is also the one in this tier that our instrument could genuinely test: a two-hour deletion promise is observable by uploading a fixture, holding the download URL and re-requesting it after the stated period, which nothing in this campaign has yet done.
Standing: Re-read: the text is unchanged, but the page publishes values that move
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- 89a887eee7ba37b5c9282823d1f6af2db73074aec41919cc47e5fdac771f7fa3
How we checked
pdfcandy.com rendered in headless Chrome with scripts/render-page.mjs on 2026-09-21 (DOM 98903 bytes, visible text 1541 bytes) carries the claim; sourceHash is the SHA-256 of that rendered homepage text. Because the sentence makes a specific retention promise and also asserts legal compliance, the linked privacy policy was read as a second source on the same day: https://pdfcandy.com/privacy-policy.html rendered to 18712 bytes of text, SHA-256 1d9ca8da7468380abb16e22dba7ba68cb1edaf9f3c8376439c46de734ff0d58c.
The claim's source is the homepage and the verdict rests on it.
-
“PDF Candy operates on ISO 27001-certified infrastructure from leading cloud providers and data centers, ensuring robust information security at every stage of document handling.”
Checked by us - the source says this Read 22 September 2026
Confirmed verbatim: "PDF Candy operates on ISO 27001-certified infrastructure from leading cloud providers and data centers, ensuring robust information security at every stage of document handling." The distinction the sentence makes is the one a reader should keep, and it is easy to lose: the ISO 27001 certification named here belongs to the infrastructure providers, not to PDF Candy. The sentence says "ISO 27001-certified infrastructure from leading cloud providers", and the section heading above it reads "ISO Certified Data Centers" - so what is certified is the data centre the files sit in, which is a genuine and checkable property of a cloud platform, and it is not the same as the company holding an ISO 27001 certificate for its own information security management system.
The company behind the site is Icecream Apps Limited of Cyprus, established when reading the privacy policy for this tool's retention claim in an earlier batch. The same page adds that servers are based in the EU and USA, and states that vulnerability assessments and penetration testing are run regularly on the systems.
No certification body or certificate identifier appears, and nothing here was independently verified.
Standing: Re-read: the text is unchanged, but the page publishes values that move
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- 8f6ed206454230ccc000e90b6619c8926dd483fc425b161c613a5b9eb9c0b6bf
How we checked
Re-verified verbatim on 2026-09-22: https://pdfcandy.com/security.html re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-pdfcandy-com-security-html-22be5049.txt.
-
“Whiteout PDF documents to hide specific text, images, or sections on the page.”
Checked by us - the source says this Read 22 September 2026
CONFIRMED covers_content, from the file rather than from the wording. The saved output carries a single new vector drawing - a pure white fill at rect (67.3, 82.0, 410.0, 108.0), which is exactly the canary band that was marked - and page one still yields the SAME 54 characters of extractable text as the input, CANARYREDACTME7F3A2B included.
So the marked text is hidden by a white rectangle and remains fully recoverable from the file by any text extractor or copy-paste. The vendor is accurate here: the tool is called Whiteout and the page says "hide", not "remove".
Scope: the web tool, one document, one date.
Standing: Re-read: the text is unchanged, but the page publishes values that move
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- c42cf1aa9c9f322df35e02a36aaab42726e671b70f43763e2b51103525f913d1
How we checked
Re-verified verbatim on 2026-09-22: https://pdfcandy.com/whiteout-pdf.html re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-17. sourceHash is the SHA-256 of the re-rendered text, held as rv-pdfcandy-com-whiteout-pdf-html-f598faea.txt.
Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked - it is not a judgement about anyone.
Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.
Alternatives to PDF Candy
What to use instead of PDF Candy The tools in this index that do the same jobs, and what separates them.