SetaPDF-Core
Commercial PHP library giving low-level access to PDF objects, metadata and encryption.
Operated by Setasign GmbH & Co. KG
Opens the vendor's own site.
Jobs covered
Open a task to see exactly what the vendor documentation supports.
Protect
Browse all protect toolsprotecting and unprotecting PDFs with SetaPDF-Core, where the manual documents the Standard Security Handler with user and owner passwords, permission flags for printing, copying, modifying, annotation and form filling, authentication against existing security handlers, creation and removal of Standard security handlers, and the Public-Key Security Handler using certificates and private keys. It supports RC4-40, RC4-128, AES-128 and AES-256; the scope records encryption, decryption, password and certificate-based security handling and permission flags, and makes no signing, certificate-trust validation, universal reader-enforcement or legal-security guarantee; SetaPDF-Signer is a separate component
Extract
Browse all extract toolsreading and inspecting PDF internals with SetaPDF-Core, where the manual documents reading PDF files of all versions, object-level parsing, transparent encryption handling, document metadata and XMP streams, pages and page geometry, annotations, outlines and destinations, embedded files, colours/fonts, page labels, viewer preferences, reader-enabled documents and corrupt-document handling. The scope records low-level document/object/metadata/page/annotation/outline/attachment inspection and reading, plus the documented writers for output; it is not a high-level text extractor, OCR engine, generic Office converter or Acrobat-style UI, and makes no arbitrary text-extraction, redaction or rendering guarantee
Where your files are processed
No server involved
A pure-PHP library running in your own process. No service and no account; documents are read and written on your own infrastructure. That is a property of the library itself: what an application built with it does with your file depends on that application, not on this.
It is an embedded PHP library, so documents are handled by the application that includes it. Pure PHP describes the language, and it does not guarantee that nothing is sent anywhere: the documented input and output includes HTTP writers and Amazon S3 stream wrappers, so where a document is read from or written to is a configuration decision rather than a property of the library.
What it does
SetaPDF-Core is the commercial low-level PHP PDF component from Setasign GmbH & Co. KG and the basis of the SetaPDF product line.
It provides PHP classes for reading, editing and writing PDF documents at object level: parsing and transparent encryption handling, document objects, pages, canvas drawing, metadata, outlines, annotations, embedded files, colours and fonts, viewer preferences, reader-enabled documents and corrupt-file handling, with writers for files, strings, streams and HTTP. It supports the standard security handler with RC4-40, RC4-128, AES-128 and AES-256, user and owner passwords and permission flags, plus public-key security with certificates and private keys.
The current documented PHP requirement is 7.2 minimum as of the 2.53.0 line, tested through PHP 8.6, with DOM, iconv or Multibyte String, OpenSSL, SPL, Zlib and intl extensions. It is sold per component through Setasign's authenticated Composer repository or a downloaded package; the server licence is EUR 180, cluster/cloud licences range from EUR 270 to EUR 810, each includes one year of updates and renews at 20% annually.
It is a PHP library, not a hosted service, and it is not SetaPDF-Signer, SetaPDF-Stamper, SetaPDF-FormFiller, SetaPDF-Merger, FPDI or SetaFPDF.
Best for
PHP applications that need to inspect or secure PDFs rather than author them: reading metadata and page geometry, validating colour usage and font embedding, applying password or certificate encryption, or repairing files that other tools refuse to open. It is also the entry point for anyone using any other SetaPDF component, since they all require it.
Worth knowing
SetaPDF-Core is a commercial component, not an open-source library or a hosted service. Public pricing is in EUR: the server licence is EUR 180 excluding German VAT and covers one server or virtual machine; cluster/cloud licences are EUR 270 for 1-3 nodes rising to EUR 810 for 1-15; each includes updates for one year, after which update access renews at 20% of the current licence price.
Licensed users get PHP source access and do not need the Ioncube Loader; trial files are Ioncube-encoded and need the loader. Composer installation uses the authenticated Setasign repository at https://www.setasign.com/downloads/ and the package setasign/setapdf-core (2.*), not public Packagist; downloaded packages or a personal pickup depot are the alternative.
The current manual states PHP 7.2 minimum as of the 2.53.0 line and testing through PHP 8.6, with DOM, iconv or Multibyte String, OpenSSL, SPL, Zlib and intl enabled; the public pages do not expose a more precise current build number, so this record keeps the 2.53 line rather than inventing a revision. Core is a low-level library: it exposes PDF objects, pages, canvas content, metadata, annotations, outlines, embedded files, fonts, colours and security handlers, but it is not an Acrobat-style editor and does not provide OCR, generic Office conversion, signing, certificate trust validation or hosted processing.
Encryption support is standard/public-key security and permission flags, not signing; SetaPDF-Signer is a separate component, as are the specialist components. The library can write to HTTP/S3-style stream wrappers as well as local files, so pure PHP does not by itself guarantee that documents never leave the host.
FPDI is a separate page-import library and is not a substitute for Core's compressed xref/object stream and encryption handling.
Details, and where each comes from
Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.
- Versions covered
- Self-hosted
- Website
- setasign.com
- Requires an account
- Not applicable
- Free tier
- No
- Watermark on trial output
- Not verified
- Maximum file size
- Not verified
- Batch processing
- Yes
- Data residency
- Self-hosted
- Open source
- No
- Self-hostable
- Yes
- Licence
-
Commercial, per-component licence under the SetaPDF Product Range Software License Agreement dated 08/2023.
Commercial, per-component licence under the SetaPDF Product Range Software License Agreement dated 08/2023. The licensor is Setasign GmbH & Co.
KG, Helmstedt, Germany. The agreement is for enterprises, grants a perpetual server or cluster/cloud licence tied to identified servers, includes one year of updates, and requires renewal for continued update access at 20% of the current licence price.
Source code access is included as of version 2.x and the Ioncube Loader is not required for licensed use; trial files are Ioncube-encoded. The agreement is governed by German law, with Braunschweig jurisdiction, and states that the German original prevails over the English translation.
No open-source licence or free tier is offered for Core.
- Redaction
- No redaction feature
- Programmatic access
- Embeddable library
- Last availability check
- Responded in 725 ms 21 October 2026
Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.
What the redaction verdict rests on
From the vendor's own documentation, read 22 September 2026. Not tested by us.
What that does not establish
Recorded as `none` on absence: the feature list is about accessing a document - objects, metadata, page boxes, annotations, bookmarks, JavaScript actions, encryption - and nothing in it removes content from a page. It reads and writes PDFs, so unlike the generators in this batch a `none` here is a statement about a real absence rather than a structural impossibility.
What it does not establish: that the other SetaPDF components lack redaction. This record covers Core only, and the vendor sells five other components that were not read.
What the vendor says
Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded - not that we tested the behaviour, unless the note says we did.
-
“The SetaPDF-Core component is a PHP library for low level access of PDF files. It represents the basis of the SetaPDF product line and is part of each individual PHP component.”
Checked by us - the source says this Read 16 October 2026
Still confirmed by the current product page and manual: SetaPDF-Core is described as a PHP library for low-level access to PDF files and as the basis of the SetaPDF product line, part of each individual PHP component. The manual documents reading/editing/writing at the lowest level, object parsing, transparent encryption and writing changes.
Standing: Not re-read against the live source
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- e0000e5bb7476121d0685e30e88df9d91b06feadadec5532a2280b173d0f947d
How we checked
Read as rendered text in headless Chrome on 2026-10-01 and saved to the evidence archive, so the read can be repeated against the same file. Comparison ignores case, punctuation and hyphenation, which is why "open-source" on the record matches "open source" on the page.
-
“Reads and writes protected/encrypted PDF files (Standard and Public-key Encryption) up to AES 256bit”
Checked by us - the source says this Read 16 October 2026
Still confirmed by the product page and the Standard and Public Key Encryption manual: the component reads and writes Standard and Public-Key encrypted PDFs and supports RC4-40, RC4-128, AES-128 and AES-256, user/owner passwords and permission flags. This is encryption/decryption, not signing or certificate-trust validation.
Standing: Not re-read against the live source
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- e0000e5bb7476121d0685e30e88df9d91b06feadadec5532a2280b173d0f947d
How we checked
Read as rendered text in headless Chrome on 2026-10-01 and saved to the evidence archive, so the read can be repeated against the same file. Comparison ignores case, punctuation and hyphenation, which is why "open-source" on the record matches "open source" on the page.
Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked - it is not a judgement about anyone.
Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.
Related reading
- Which PDF tools keep your file on your machine - what we count as processing on your own device.