pdf-lib
JavaScript library for creating PDFs and filling forms, pages and metadata.
Where your files are processed
No server involved
A pure JavaScript library operating on in-memory byte arrays in your own runtime. No vendor service and no runtime downloads, so it can be fully air-gapped. That is a property of the library itself: what an application built with it does with your file depends on that application, not on this.
Inherent to the technology rather than a vendor claim: a pure JavaScript library operating on in-memory byte arrays in whatever runtime you load it into, with no vendor service in the loop. There is no runtime data download, so it can be fully air-gapped.
What it does
A dependency-light JavaScript library that creates PDFs from scratch and loads and modifies existing ones, in browsers, Node, Deno and React Native. It adds, inserts, removes and copies pages between documents, draws text, images, vector graphics and embedded PDF pages, embeds and subsets fonts, sets metadata and viewer preferences, and creates, fills, reads and flattens AcroForm fields. It deliberately does not handle encryption: an encrypted input throws rather than decrypting.
Best for: Projects that need to generate PDFs or programmatically fill, stamp and restructure existing ones entirely client-side, and that either do not need encryption or will pair it with a separate tool.
Worth knowing: No encryption support at all — loading an encrypted PDF throws, and there is no API for writing a password-protected file, so it cannot cover password protection. It also cannot read or edit body text outside form fields, and the repository has had no commits since July 2024.
Details, and where each comes from
Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.
- Versions covered
- Web · Self-hosted
- Website
- pdf-lib.js.org
- Requires an account
- Not applicable
- Watermark on the free tier
- Not verified
- Maximum file size
- Not verified
- Batch processing
- Not verified
- Data residency
- Self-hosted
- Open source
- Yes
- Self-hostable
- Yes
- Licence
- MIT
- Redaction
- No redaction feature
- Programmatic access
- Embeddable library · Browser JavaScript
- Last availability check
- Responded in 85 ms 16 October 2026
Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.
What the redaction verdict rests on
From the vendor's own documentation, read 22 September 2026. Not tested by us.
What that does not establish: The vendor’s own site was read on 22 September 2026 and contains no mention of redaction, sanitisation, blackout or whiteout. Absence from a vendor’s own material is not proof that a feature does not exist — it may be undocumented, or on a page the reading did not reach — but for a NEGATIVE claim it is the strongest evidence available, and it is weaker than a positive quote. Recorded as such rather than presented as certainty.
What the vendor says
Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded — not that we tested the behaviour, unless the note says we did.
-
“pdf-lib does not currently support encrypted documents.”
Checked by us — the source says this Read 22 September 2026
Confirmed verbatim: "pdf-lib does not currently support encrypted documents." The README continues with the operational detail the claim leaves out and a user needs: "You should not use pdf-lib with encrypted documents. However, this is a feature that could be added to pdf-lib. Please create an issue if you would find this feature helpful!" It then documents the behaviour — PDFDocument.load throws on an encrypted document — and the escape hatch, an ignoreEncryption: true option that loads the document anyway. That last part is the practical nuance: the library will read an encrypted file if told to ignore the encryption, which is not the same as supporting encryption and is worth knowing before choosing it for a workflow that involves protected files. This is a negative capability claim of the kind this project has settled by inspection before, in the pikepdf API audit; here it was settled by reading the library's own README, and no inspection of the code was performed.
Standing: Re-read: the text is unchanged, but the page publishes values that move
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- 8ab918ba9f32fd9f96d31761b53fffd3e9c4d8b61122f5e1843279646392e1ca
How we checked: Re-verified verbatim on 2026-09-22: https://github.com/Hopding/pdf-lib re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-github-com-Hopding-pdf-lib-b6cbabb3.txt.
-
“Supporting modification (editing) of existing documents.”
Checked by us — the source says this Read 22 September 2026
Confirmed verbatim: the sentence appears unaltered in the README's feature list, as one item among several. It is a positive capability claim sitting in the same document as the negative one already recorded — that pdf-lib "does not currently support encrypted documents" — and reading them together is the useful thing: modification is supported, and only for unencrypted files. A developer who skimmed this feature list could take "modification of existing documents" as general, when the encryption entry two sections away bounds it.
Standing: Re-read: the text is unchanged, but the page publishes values that move
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- 8ab918ba9f32fd9f96d31761b53fffd3e9c4d8b61122f5e1843279646392e1ca
How we checked: Re-verified verbatim on 2026-09-22: https://github.com/Hopding/pdf-lib re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-github-com-Hopding-pdf-lib-b6cbabb3.txt.
Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked — it is not a judgement about anyone.
Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.
Related reading
- Which PDF tools keep your file on your machine — what we count as processing on your own device.
- Open source PDF tools, and what their licences require — what open source does and does not tell you.