pdfcpu
Go PDF library and CLI for validation, assembly and encryption.
Where your files are processed
No server involved
A compiled Go library and CLI that runs in-process on the caller's machine, with no service component. That is a property of the library itself: what an application built with it does with your file depends on that application, not on this.
Architectural: a compiled Go library and CLI that runs in-process on the caller's machine. It has no service component, so processing cannot leave the host.
What it does
A PDF processing library and command-line tool written in Go. It validates against PDF 1.7 and 2.0, merges, splits, trims and assembles documents, adds stamps and watermarks, encrypts and decrypts with passwords and permissions, manages attachments, portfolios, bookmarks and form data, and can optimise files. It offers both a file-based and a stream-based Go API, so it drops into servers and pipelines.
Best for: Go teams and shell automation that want PDF assembly, encryption and validation in one dependency-light binary.
Worth knowing: There is no documented general redaction workflow: the command set has no redact, delete-content or sanitise operation for arbitrary text or images. That is separate from removal, which the project does document — stamps, watermarks and signatures can be removed, and pages and objects can be manipulated. Those operations are not proof that arbitrary page content has been securely removed, and they are not a redaction workflow. PDF support runs through version 2.0, and the project describes its PDF 2.0 validation as basic and continuously improving rather than as complete coverage.
Details, and where each comes from
Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.
- Versions covered
- Windows · macOS · Linux · Self-hosted
- Website
- pdfcpu.io
- Requires an account
- Not applicable
- Watermark on the free tier
- Not verified
- Maximum file size
- Not verified
- Batch processing
- Yes
- Data residency
- Self-hosted
- Open source
- Yes
- Self-hostable
- Yes
- Licence
- Apache-2.0
- Redaction
- No redaction feature
- Programmatic access
- Embeddable library · Command line
- Last availability check
- Responded in 212 ms 16 October 2026
Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.
What the redaction verdict rests on
From the vendor's own documentation, read 22 September 2026. Not tested by us.
What that does not establish: The repository README is the source, because pdfcpu.io renders its documentation from JavaScript. The project describes itself as PDF tooling for Go and the command line, and lists validation, optimisation, encryption and page assembly — no redaction. The vendor’s own published material was read on 22 September 2026 and contains no mention of redaction, sanitisation, blackout or whiteout. Absence from a vendor’s own material is not proof that a feature does not exist — it may be undocumented, or on a page the reading did not reach — but for a NEGATIVE claim it is the strongest evidence available, and it is weaker than a positive quote. Recorded as such rather than presented as certainty.
What the vendor says
Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded — not that we tested the behaviour, unless the note says we did.
-
“pdfcpu is a PDF processing library and command-line tool written in Go. It supports validation, optimization, encryption, signing, document assembly, content extraction, and other common PDF operations.”
Checked by us — the source says this Read 22 September 2026
Confirmed verbatim: "pdfcpu is a PDF processing library and command-line tool written in Go. It supports validation, optimization, encryption, signing, document assembly, content extraction, and other common PDF operations." The README's own next sentence is a scope note worth carrying: "pdfcpu supports PDF versions through PDF 2.0 (ISO 32000-2). PDF 2.0 validation support is basic and continuously improving." So the newest specification is supported and its validation is explicitly described as basic, which is exactly the kind of qualifier a vendor usually leaves out and which matters to anyone relying on a validation result. Note the contrast with pdf-lib's entry in this index, verified in the same batch: one library documents encryption support and the other documents its absence, and both statements are the projects' own. Recorded as the project's description; we have not run pdfcpu and no control was run.
Standing: Re-read, and the recorded hash was not reproduced
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- 22a561b621f877b59ad25e08a5088a9c346bf32571396573f1b54ea4441573e6
- Note
- real drift in GitHub's own page shell, not in the claim: a feature-flag name ("ui_service_compute_proxy_control") was added to the repository page config, +758 characters. RE-READ 2026-09-21: the README sentence the claim quotes is present verbatim, so the verdict stands.
How we checked: Re-verified verbatim on 2026-09-22: https://github.com/pdfcpu/pdfcpu re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-github-com-pdfcpu-pdfcpu-0b72f949.txt.
Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked — it is not a judgement about anyone.
Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.
Related reading
- Which PDF tools keep your file on your machine — what we count as processing on your own device.
- Open source PDF tools, and what their licences require — what open source does and does not tell you.