PyMuPDF

What it does

PyMuPDF binds the MuPDF C engine into Python for extraction, rendering and editing of PDF along with XPS, EPUB, MOBI, comics and image inputs. It renders pages to pixmaps, pulls text, tables and vector graphics, runs Tesseract OCR, reads and writes annotations, form fields, outlines and metadata, merges and splits documents, and applies encryption. Redaction is a deliberate two-step API: annotate an area, then apply the redactions to permanently strip the underlying content.

Best for: Teams that need high-speed rendering plus genuinely destructive redaction in Python, and whose licence position can accommodate AGPL or an Artifex commercial licence.

Worth knowing: AGPL-3.0 is a hard blocker for a closed-source network service unless you buy a commercial licence from Artifex. PyMuPDF is also not thread-safe — its maintainers recommend multiprocessing — and redaction has historically been buggy, with a stream of fixes for text outside the marked area and incomplete removal of vector graphics.

Details, and where each comes from

Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.

Versions covered

Windows · macOS · Linux · Self-hosted

Website

pymupdf.readthedocs.io

Requires an account

Not applicable

Watermark on the free tier

Not verified

Maximum file size

Not verified

Batch processing

Yes

Data residency

Self-hosted

Open source

Yes

Self-hostable

Yes

Licence

AGPL-3.0

Redaction

Removes the content

Programmatic access

Embeddable library · Command line

Last availability check

Responded in 234 ms 16 October 2026

Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.

What the vendor says

Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded — not that we tested the behaviour, unless the note says we did.

• “Step 2: Apply — permanently removes the underlying content”

  Checked by us — the source says this Read 22 September 2026

  Confirmed, and this is the strongest kind of entry in the register — the wording and our own observation agree. The README's answer to 'How do I permanently redact (remove) content from a PDF?' carries the line '# Step 2: Apply — permanently removes the underlying content', which is the claim unaltered, and adds: 'After apply_redactions(), the original content is gone. It cannot be recovered from the saved file.' Our own test found the same: the marked text is deleted from the page structure and a fill is painted, and the canary string did not survive in the saved file. Two limits worth recording that the README states and the claim does not: redaction is deliberately two-step, marking then applying, so a document saved between the two steps is unchanged; and the text is removed from what PyMuPDF examines, which is the page content, so the same caveats about annotations, forms and embedded files that pikepdf documents apply here as well.

  Standing: Re-read, and the recorded hash was not reproduced

  Check it yourself: the source, the SHA-256, and how we checked

  Read

  https://pymupdf.readthedocs.io/en/latest/about.html

  From

  the text a browser renders

  SHA-256

  7008f1cadaff06ca8bd249db6aaef2aad22665897de92e8db4798c79969c985b

  Note

  no saved artifact matches this hash, so there is nothing to normalise towards. Both a raw fetch and a render of the About page fail to reproduce it.

  How we checked: Re-verified verbatim on 2026-09-22: https://github.com/pymupdf/PyMuPDF re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-github-com-pymupdf-PyMuPDF-032c63dc.txt.

  What this hash proves, and what it does not

• “PyMuPDF and MuPDF are now available under both, open-source AGPL and commercial license agreements.”

  Checked by us — the source says this Read 22 September 2026

  Confirmed verbatim: the sentence appears unaltered in the About page. The page continues with the practical half, which is what a reader needs: the AGPL terms are in the distribution as a COPYING file, and "if you determine you cannot meet the requirements of the AGPL, please contact Artifex for more information regarding a commercial license". This is the third Artifex licence in this batch alongside Ghostscript and MuPDF, and the fourth AGPL-plus-commercial structure alongside borb and iText, so the index now records the same licensing shape across five projects. This is also the project whose redaction behaviour was established by test earlier in this index — see pymupdf#2 — where the testing method is recorded rather than a reading.

  Standing: Re-read and matched byte for byte

  Check it yourself: the source, the SHA-256, and how we checked

  Read

  https://pymupdf.readthedocs.io/en/latest/about.html

  From

  the text a browser renders

  SHA-256

  fcf34285f17e7149deeccb54b69ccb585fdbff69973e143900fe880cab1179a2

  How we checked: Re-verified verbatim on 2026-09-22: https://pymupdf.readthedocs.io/en/latest/about.html re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-pymupdf-readthedocs-io-en-latest-about-html-82d82f92.txt.

  What this hash proves, and what it does not

• “Text contained in a redaction rectangle will be physically removed from the page (assuming Document.save() with a suitable garbage option) and will no longer appear in e.g. text extractions or anywhere else.”

  Checked by us — the source says this Read 22 September 2026

  RE-QUOTED 2026-09-22: this claim previously read "Redaction is genuine removal: annotate the area, apply the redactions, and the content underneath is deleted rather than covered." — our characterisation rather than the vendor's wording, so a reader could not tell a quotation from a summary. The vendor's own sentence is now in the claim field and what we read from it follows here. The boxed string is gone from the saved file; the lines 40pt above and below it survived, as did the untouched second page, so the removal is localised. The output contains zero image XObjects, so nothing was rasterised: the marked text is deleted from the page structure and a solid fill is drawn in its place. qpdf reports no errors and agrees on every marker. This matters more here than elsewhere: PyMuPDF's own changelog records a long stream of redaction fixes, including incomplete removal of vector graphics and text falling outside the annotated box, so the record warns readers to regression-test rather than assume. It passed this test — one document, one box, one version — which is evidence and not a warranty.

  Standing: Re-read and matched byte for byte

  Check it yourself: the source, the SHA-256, and how we checked

  Read

  https://pymupdf.readthedocs.io/en/latest/page.html

  From

  the raw HTTP response

  SHA-256

  d995809985f9fbed54cdde23cfff7e3782950c7342e6697622ba35729408dcc7

  How we checked: Re-verified verbatim on 2026-09-22: https://pymupdf.readthedocs.io/en/latest/page.html rendered in headless Chrome with scripts/render-page.mjs, and this sentence found in the rendered text. ALSO RE-QUOTED on the same date: the claim field previously held our own summary of this page rather than the vendor's sentence, which made it impossible to verify by quotation — the schema's own words are "we do not repeat a vendor's claim as though it were our own finding", and the reverse holds too. sourceHash is the SHA-256 of the rendered text, held as p12-pymupdf-page.txt.

  What this hash proves, and what it does not

Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked — it is not a judgement about anyone.