Skip to content
dialegein

pdfcpu

Apache-2.0 Go PDF library and CLI for validation, assembly, extraction and encryption.

Jobs Protect Merge Edit Compress Extract

Since 2017

Operated by Horst Rutter

Visit pdfcpu

Opens the vendor's own site.

Jobs covered

Open a task to see exactly what the vendor documentation supports.

Protect Browse all protect tools

encrypting, decrypting and access-controlling PDFs with pdfcpu, where the security commands document encryption and decryption, changing owner and user passwords, and listing or setting permissions, with the 0.16.2 release notes describing AES-256 password handling and extraction-permission enforcement. The scope records password-based encryption/decryption, owner/user password changes and permission inspection/update, and makes no universal reader-enforcement, unbreakable-encryption, certificate-trust, legal-security or signature guarantee; signature validation and removal are a separate capability, not part of protect

Merge Browse all merge tools

merging and assembling PDFs with pdfcpu, where the CLI and Go API document merge create/append/zip modes, sorting inputs, bookmarks and bookmark modes, divider pages, optional optimization and signature removal, and the separate split, trim and collect page-assembly commands. The scope records merging multiple PDFs into a new or existing document, appending, zip interleaving, page assembly and the documented bookmark/divider options, and makes no claim to edit page content, render pages, preserve signatures or convert to other document formats

Edit Browse all edit tools

page insertion, removal and rearrangement, stamps, watermarks, forms, bookmarks and document properties

Compress Browse all compress tools

optimizing PDFs by removing redundant page resources

Extract Browse all extract tools

extracting PDF internals with pdfcpu, where the extract command documents image, font, content, page and metadata modes, with page selection: images and fonts written to disk, raw page content in PDF syntax, actual pages as single-page PDFs, and embedded XML metadata. The scope records image, font, raw-content, page and metadata extraction, explicitly notes that it does not extract plain text from the text layer and has no OCR or attachment-extraction mode, and makes no redaction or arbitrary content-removal claim

Where your files are processed

No server involved

A compiled Go library and CLI that runs in-process on the caller's machine, with no service component. That is a property of the library itself: what an application built with it does with your file depends on that application, not on this.

Architectural: a compiled Go library and CLI that runs in-process on the caller's machine. It has no service component, so processing cannot leave the host.

What it does

pdfcpu is an Apache-2.0 PDF processing library and command-line tool written in Go, with a Go API and CLI. The current release is v0.16.2, published 11 October 2026; go.mod declares Go 1.26.0 and the release notes say building requires Go 1.26 or later, while the published binaries were built with Go 1.27.2.

Official release assets include Darwin arm64 and x86_64, Linux arm64, armv7, i386 and x86_64, Windows i386 and x86_64, a JS/WASM build, checksums and source. pdfcpu validates against PDF 1.7 and basic PDF 2.0 checks, optimizes, splits, trims, collects and merges PDFs, extracts images, fonts, raw page content, pages and embedded XML metadata, encrypts and decrypts with owner/user passwords and permissions, resizes and rotates pages, adds and removes stamps and watermarks, manages attachments and portfolios, and validates signature integrity, reports signature evidence and removes signatures.

Signature validation uses a local trusted-certificate store, optionally initialised from an EU Trusted List snapshot in a pdfcpu_eutl build; there is no signing API and no legal/eIDAS/trust guarantee. It runs locally as a Go library or binary with no hosted service.

Best for

Go teams and shell automation that want PDF assembly, encryption and validation in one dependency-light binary.

Worth knowing

The current release is v0.16.2, published 11 October 2026. go.mod declares Go 1.26.0 and the release notes say building requires Go 1.26 or later, not the earlier Go 1.25 requirement; the published binaries were built with Go 1.27.2. Official assets cover Darwin arm64/x86_64, Linux arm64/armv7/i386/x86_64, Windows i386/x86_64 and JS/WASM, plus source; there is no hosted pdfcpu service.

The extract command's documented modes are image, font, content, page and meta: it does not extract plain text from the text layer, does not perform OCR, and does not offer an attachment extraction mode; attachments and portfolios are managed by separate commands. Raw page content is PDF content-stream syntax, not extracted text.

Merge supports create, append and zip modes with bookmarks, dividers, sorting and optional signature removal; split, trim and collect are separate page-assembly commands. Security commands cover encryption/decryption, owner/user password changes and reading or setting permissions, including AES-256 handling described in the 0.16.2 release notes; they do not provide universal reader enforcement or a security guarantee.

Signature support is validation, evidence reporting and removal only: there is no signing API, standard builds start with an empty trusted-certificate store, importing a certificate does not establish legal validity, eIDAS compliance or an enterprise trust policy, and signature validation is not a legal or regulatory-compliance assessment. Validation is not complete ISO 32000 compliance, PDF 2.0 coverage is basic and improving, and strict/relaxed validation policies do not select PDF/A or constitute signature trust.

No general redaction workflow is documented, and the absence of a redaction command is not proof that content has been securely removed. No generic Office/PDF conversion, rendering, OCR or arbitrary body-text editing is claimed.

Details, and where each comes from

Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.

Versions covered
Windows · macOS · Linux · Self-hosted
Website
pdfcpu.io
Requires an account
Not applicable
Watermark on the free tier
Not verified
Maximum file size
Not verified
Batch processing
Yes
Data residency
Self-hosted
Open source
Yes
Self-hostable
Yes
Licence
Apache-2.0.

Apache-2.0. The repository LICENSE.txt is the Apache License, Version 2.0.

The README identifies Horst Rutter as the maintainer of pdfcpu and notes his PDF Association membership; the Go module is github.com/pdfcpu/pdfcpu. No price, subscription or hosted service is published; the Apache-2.0 licence is the terms.

Redaction
No redaction feature
Programmatic access
Embeddable library · Command line
Last availability check
Responded in 142 ms 21 October 2026

Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.

What the redaction verdict rests on

From the vendor's own documentation, read 22 September 2026. Not tested by us.

What that does not establish

The repository README is the source, because pdfcpu.io renders its documentation from JavaScript. The project describes itself as PDF tooling for Go and the command line, and lists validation, optimisation, encryption and page assembly - no redaction.

The vendor’s own published material was read on 22 September 2026 and contains no mention of redaction, sanitisation, blackout or whiteout. Absence from a vendor’s own material is not proof that a feature does not exist - it may be undocumented, or on a page the reading did not reach - but for a NEGATIVE claim it is the strongest evidence available, and it is weaker than a positive quote.

Recorded as such rather than presented as certainty.

https://github.com/pdfcpu/pdfcpu

What the vendor says

Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded - not that we tested the behaviour, unless the note says we did.

  • “pdfcpu is a PDF processing library and command-line tool written in Go. It supports validation, optimization, encryption, document assembly, content extraction, signature validation and signature removal, and other common PDF operations.”

    Checked by us - the source only partly supports this Read 16 October 2026

    The README opening sentence says pdfcpu supports signing, but its own feature list and the Go API expose signature validation/evidence and removal, not a signing operation. The claim is therefore corrected to signature validation and removal rather than signing; certificate-store trust checks are separate and do not establish legal validity or eIDAS compliance.

    Standing: Re-read, and the recorded hash was not reproduced

    Check it yourself: the source, the SHA-256, and how we checked
    Read
    https://github.com/pdfcpu/pdfcpu
    From
    the text a browser renders
    SHA-256
    22a561b621f877b59ad25e08a5088a9c346bf32571396573f1b54ea4441573e6
    Note
    real drift in GitHub's own page shell, not in the claim: a feature-flag name ("ui_service_compute_proxy_control") was added to the repository page config, +758 characters. RE-READ 2026-09-21: the README sentence the claim quotes is present verbatim, so the verdict stands.

    How we checked

    Re-read on 2026-10-16 against the current README features and the Go API: the README feature list says validate, optimize, split, trim and merge; extract and manipulate images, fonts and metadata; encrypt and decrypt; validate signature integrity, report signature evidence and remove signatures; and manage attachments and portfolios. The Go API exposes ValidateSignatures and RemoveSignatures but no signing function.

    The original README opening sentence used the broad word signing; the claim is narrowed to the validated/removal capability actually exposed, and the sourceHash remains the README evidence file.

    What this hash proves, and what it does not

Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked - it is not a judgement about anyone.

Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.

Visit pdfcpu Report a problem

Related reading

How this record was put together

Editorial review.
No editor has signed this record off. That is not the same as nothing having been checked, and the lines below say what has.
Source reading.
1 claim taken from the vendor's own pages, read between 16 October 2026 and 16 October 2026.
Website availability.
The vendor's site was last checked on 21 October 2026.
Behaviour testing.
We ran this ourselves. The file handling was watched directly.

Sources: github.com/pdfcpu/pdfcpu (repository, README, LICENSE, API metadata); pdfcpu.io about and watermark documentation.