PDF Workbench: A Free PDF Editor That Runs in Your Browser and Never Uploads Your Files

Every “free online PDF tool” has the same catch. The file goes to somebody’s server, gets processed there, and comes back, and the terms of service say what happens to it in between. For a scanned lease, a signed contract or a medical form, that is a strange thing to accept in exchange for rotating a page. PDF Workbench takes the other route. The whole editor is one web page; the PDF is opened in the tab, edited in the tab and saved from the tab, and no byte of it is sent anywhere. Merge, split, reorder, rotate, watermark, number pages, annotate, sign, fill forms, extract text, run OCR on scans, compress, build a PDF from photos, and ask an AI model about the contents with a key that stays on your machine.

Video: Computerphile, “PDF, What is it FOR?”

What it does

Twelve jobs, one page, no account

The left column lists the tools. Pages shows every page as a thumbnail: drag to reorder, click to select, rotate or delete with the buttons under each one, and use the right-hand panel to extract a range (“1-3, 7”), split the file into chunks of N pages, or append more PDFs to the end. Stamp adds a diagonal watermark, page numbers in any corner with a “Page {n} of {N}” template, and a header or footer line. View is the reading mode: one page at a time at full size, with ‹ › or the arrow keys to turn pages, + and − or Ctrl-scroll to zoom from 50% to 300%, and a fit-to-width default; double-clicking a thumbnail in Pages jumps straight to that page. Markup & Sign puts a drawing layer on top of the same viewer: freehand ink, yellow highlight, boxes, typed text, and a signature drawn with a mouse or a finger (or typed, for the keyboard-only) that can be dropped anywhere. Forms lists every fillable field in the document, lets you fill it, and optionally flattens the result so the values become permanent.

Text & OCR extracts the text layer in a second, or, for a scan with no text layer, runs optical character recognition in the browser and adds an invisible text layer so the PDF becomes searchable while still looking exactly like the scan. Compress re-renders every page as a JPEG at a resolution you choose, which can take a 40 MB scanned contract down to a few megabytes. Images → PDF turns a set of JPG or PNG files into a document, one page each, fitted to A4 or US Letter. The AI assistant summarises, pulls key facts, suggests a file name or answers a question, using a Gemini API key you paste in once. Download hands back the edited file; nothing is kept once the tab closes.

The app lives at apps.x9m8.com/pdf-workbench and the source is on GitHub. A sample scanned page is built in for trying OCR without hunting for a scan.

The page is also a small installable app. A large Bookmark button at the top turns into an Install button in browsers that support it, and after the first visit the editor and its libraries are cached, so it opens without a connection. A link in the header opens the tool in its own tab when it is embedded in this post, which is the one to bookmark.

Why a browser can do this now

Three open-source libraries and twenty years of the format being public

PDF was Adobe’s. John Warnock, the company’s co-founder, started the Camelot Project in 1991 with a paper proposing a simplified PostScript for exchanging documents; the format shipped in 1993 and the specification was given away free, but the format itself stayed proprietary until Adobe released it as an open standard on 1 July 2008 as ISO 32000-1, handing control to an ISO committee and publishing a royalty-free patent licence. PDF 2.0 followed as ISO 32000-2 in 2017, and in April 2023 the PDF Association made that specification free to download. PDF is, in the words of the Wikipedia article, “based on the PostScript language,” a declarative subset of it with font embedding and a structured container bolted on. Because the spec is open, anyone can write a reader or a writer, and three people did the hard parts in JavaScript.

Rendering is PDF.js, which Andreas Gal started at Mozilla in 2011 as an experiment: could a PDF be drawn with nothing but the HTML5 canvas? It could. The library became Firefox’s built-in viewer in 2012 and the default in 2013, and today it previews PDFs inside Dropbox, Slack, Thunderbird and Nextcloud. It is Apache-licensed, and it is what draws the thumbnails, the View page and the markup layer here.

Editing is pdf-lib, an MIT-licensed library whose one-line description is “Create and modify PDF documents in any JavaScript environment.” It parses the file into objects, lets the page copy, rotate, remove and insert pages, draw text, lines, rectangles and images onto them, read and write form fields, and serialise the result back to bytes. Every edit in PDF Workbench is a pdf-lib operation followed by a save, and the saved bytes are what you download.

Recognition is Tesseract. Hewlett-Packard built it as proprietary software at its labs in Bristol and Greeley between 1985 and 1994; a 1995 accuracy test put it among the top three engines of the day; HP and the University of Nevada, Las Vegas released it as open source in 2005, and Google has developed it since 2006. Version 4 replaced the classic engine with an LSTM neural network and brought the language count to 116. Tesseract.js is the same engine compiled to WebAssembly, so it runs inside the tab. The first OCR run downloads the engine and about ten megabytes of language data; after that it is cached.

What “never uploaded” means in practice

The network tab is the proof

Open the browser’s developer tools, switch to the Network panel, and use the app. The page loads its three libraries from a content delivery network and, on the first OCR run, Tesseract’s language data. After that the panel is empty. Opening a file, editing it and downloading the result produce no requests at all, because the file is a buffer in the tab’s memory and the download is a blob URL the browser creates locally. Close the tab and the buffer is gone.

The one deliberate exception is the AI assistant, and it is opt-in twice over. Nothing happens until a Gemini API key is pasted in, and the key is kept in the browser’s local storage, not on any x9m8 server, because there is no x9m8 server behind this page. When a question is asked, the extracted text of the document goes from the tab directly to Google’s API with that key. That is a real transfer, to Google, under Google’s terms, and the panel says so before the first request. Anyone who would rather not can simply never use that tab; every other tool works without a key and without a network.

Where it falls short of a desktop editor

Honest limits

A desktop product like Adobe Acrobat or Qoppa’s PDF Studio does things this page does not. It cannot edit the existing text of a PDF in place; it can only add marks on top, which is the difference between correcting a typo and sticking a label over it. Its redaction is not a redaction: a black box drawn in Markup covers the words visually but the text underneath is still in the file, so for anything that matters, flatten the page by running Compress first, which turns the page into an image, then cover. It does not encrypt or password-protect, because pdf-lib does not write encryption. Compress works by rasterising, so a text PDF that is already small gains nothing and may grow; the app tells you and keeps the original when that happens. Merging another file in appends its pages but drops that file’s form fields. And OCR in the browser is slower than on a server: expect a few seconds a page, longer on a phone.

Within those limits the trade is a good one. Most PDF chores are page chores, stamp chores and signature chores, and the privacy of doing them on your own machine costs nothing but a slightly longer first load.

Under the hood

How a page becomes editable

A page in PDF Workbench exists in two forms at once. PDF.js renders it to a canvas for display, and reports a viewport that maps canvas pixels to PDF user units, points measured from the bottom-left corner. When you draw on the markup layer, the strokes are stored in those PDF units, not in pixels, so zooming the view does not move them. When you press Apply, pdf-lib opens the current bytes, draws each stroke, box, text or signature image onto the matching page in the same units, and saves. The viewer then re-renders from the new bytes, and the marks are now part of the document rather than an overlay.

Rotated pages are the awkward case. A page with a /Rotate 90 entry is stored sideways and displayed upright, so a watermark drawn at the stored centre comes out sideways on screen. The stamp tool computes the page’s visual geometry first, maps the visual position back into stored coordinates, and rotates the text by the same angle, which is why “Page 3 of 10” lands in the corner you asked for on a page that was scanned in landscape.

OCR does the same mapping in the other direction. Tesseract returns each recognised word with a pixel bounding box in the rendered image. The app scales those boxes back to page points and draws the word there in fully transparent Helvetica, sized to the box height. Search, select and copy all work on that invisible text; the eye still sees the scan. It is the same trick commercial scanners use, done in the tab.

The whole app is one HTML file with no build step, in the same spirit as the simulations published earlier on this site: the cellular automata lab, the Mandelbrot explorer and the rest. If a feature breaks on a particular file, the file never left your computer, which also means the only way to report it is to describe it.

Things to try

• Drop a phone photo of a receipt onto the page with no PDF open. It becomes a one-page PDF; run OCR; copy the total.
• Open a long report, go to Pages, select the appendix with Shift-click and press Delete. Then Stamp a “DRAFT” watermark at 25% opacity.
• Open a form someone sent you, fill it under Forms, tick Flatten, then go to Markup & Sign, draw your signature once and drop it on the signature line. Download. The whole round trip took no email attachment and no printer.
• Take a 30-page scan at 300 dpi and Compress it at 110 dpi, quality 0.6, greyscale. Compare the two sizes in the status bar.
• Paste a Gemini key, open a dense PDF and click Key facts. Then open the Network panel and watch exactly one request leave the tab.

For what is inside the file format itself, objects, streams, cross-reference tables and why a PDF can be edited without being rebuilt, John Whitington’s PDF Explained is the short O’Reilly guide to the ISO standard.

Sources

• PDF history, Camelot, the 2008 ISO release, PDF 2.0, PostScript basis: Wikipedia, PDF
• PDF.js origin, Firefox adoption, licence, who uses it: Wikipedia, PDF.js
• Tesseract history, open-sourcing, LSTM engine, language count: Wikipedia, Tesseract (software)
• pdf-lib description, features and licence: pdf-lib on GitHub
• Video: Computerphile, PDF, What is it FOR?
• Book: PDF Explained on Amazon (affiliate link)