An offline PDF editor built in Rust. Your files stay on your computer.
English · Français · العربية · Español · Português · Deutsch · 简体中文 · 日本語 · 한국어
Explore the workstation · Build guide · Roadmap
Finish a form. Put pages in order. Add a note. Save a separate copy. PDF Editor Offline is a free, open-source PDF workstation and Rust CLI. No account, subscription or document upload is required.
Install the CLI · Run the desktop · See what's next
Available now: native CLI 4.0.0-preview.4 for macOS, Windows and Linux. The desktop builds from source; installers and full PDF editing are still in development. The gallery shows real macOS sessions with public synthetic PDFs.
A little less PDF chaos. Find the right page, give it a new order, add a few words or a drawing, then save a copy. Start with the public demo PDF and try things without putting a private document in a public example.
The screenshot is a real app window using a public synthetic PDF. More native captures · Runtime evidence
Today's source checkpoints: original-text font changes, Unicode TrueType embedding, whole-image/text redaction and decoding fixes passed 798 tests across 95 suites, including pinned independent readers and actual native workers, with no failures or ignored tests. The newer typed/image signature integration passed 229 native tests, including every pinned reference, with no failures or ignored tests. Strict workspace Clippy and documentation checks passed; the dependency graph is unchanged from the audited workspace. Exact sources and scope. The preceding font milestone passed all five platforms and the quality job in native CI and security scanning. Those platform runs do not verify the newer image-redaction/signature changes. Preview.4 is published on GitHub and npm, with five-platform HTTPS global-install checks passed. Release and registry evidence.
Numbering, image placement/replacement and original text properties ship in preview.4. Font changes, redaction and decoding fixes require current source; build the desktop for the native canvas workflows.
Fresh tools to play with: draw on the canvas, draw, type or place a visual signature, place an image, replace one existing image, number pages, edit supported existing text, change its font, remove complete supported image assets, add Unicode text, finish a form or leave a sticky note.
Open this week's workflow notes
| Try it | See it work |
|---|---|
| Add Unicode text with a font, color and alignment | Before/after exports and commands |
| Draw rectangles, ellipses, lines and freehand paths | Canvas controls and reproducible CLI example |
| Place a PNG/JPEG on an existing PDF page | Image placement, resize and rotation |
| Replace one image while keeping its other shared occurrences | Source-bound replacement and preservation limits |
| Number selected pages in one undoable operation | Upright numbering and reproducible commands |
| Move, resize or recolor supported original text | Text properties and exact byte preservation |
| Fill text fields, dropdowns and list selections | A public form you can finish |
| Add, edit and remove basic sticky notes with undo | Desktop note walkthrough |
| Combine supported PDFs into a new desktop tab | Merge workflow |
| Split supported PDFs into new tabs or CLI files | Split workflow and publication limits |
| Open a password-protected PDF for this session | Read-only encrypted viewing |
| Make a targeted cleanup copy with a removal report | What sanitization removes |
Six real macOS captures, assembled into a 15-second slideshow: open, choose a PNG, zoom, insert, undo and save a new copy. The public synthetic source stays intact. Inspect the saved PDF and review scope.
| Before | After adding text |
|---|---|
 |
 |
These are rendered PDF exports, not interface mockups. Added text does not replace or erase existing content. Reproduce the result.
Choose a TrueType font, change supported original text, undo, redo and save a copy. This actual source-build session reopened the PDF and changed the Unicode text again using its embedded font. Try the font workflow · Inspect the saved copies and independent checks. This feature is newer than the published CLI preview. Editing preserves old source streams; use the separate supported redaction workflow for removal.
The source build can remove complete supported image assets into a verified new copy. Select every shared use, review the result and Save As. This real macOS session also tested incomplete-selection refusal and reopened both saved copies. Try whole-image redaction · Inspect the real saved-file proof. The current profile covers plain/Flate RGB/Gray8 images and supported masks; partial-pixel regions and arbitrary-PDF privacy verification remain unfinished.
Latest changes · Live CI · Source status and remaining work
Just looking? Open the real gallery. Ready to try it? Install the CLI or build the desktop. Here to make something? Recreate the text example or explore the Rust workspace.
If this is a tool you'd use, star the repository to keep it within reach. Want to help it grow? Try a workflow, compare the saved PDF in another viewer, or contribute a focused improvement from the roadmap. Use synthetic documents for public examples.
A small root, with a place for everything
The project is a Rust workspace. Build outputs stay outside this checkout.
| Directory | Purpose |
|---|---|
apps/ |
Native desktop and command-line applications |
crates/ |
PDF parsing, editing, rendering, conversion and worker isolation |
docs/ |
Guides, translations, screenshots and verification evidence |
distribution/ |
The optional npm installer and release preparation |
examples/, tests/, tools/ |
Reproducible examples, fixtures and development tools |
site/ |
The public showcase and documentation website |
vendor/ |
Required vendored source and its licenses |
The root keeps workspace manifests, project documentation, the license and
quality configuration. Screenshots live in docs/assets/.
The tidy-up quest. Find your page, rotate that sideways scan, put the pages in order and save a separate copy. Your original stays where it is.
The one-file handoff. Choose Edit → Merge PDF files… in a desktop source build, arrange compatible PDFs and create a new document. Merge scope and checks explain the guarded tier.
The fill-it-in moment. Finish a supported form, add Unicode text or draw a shape. Try the form, text or drawing walkthrough in a current-source build.
The repeat job. Let the Rust CLI handle supported page operations and JSON
inspection. Preview a change with --dry-run before writing.
Before sharing. Targeted cleanup can remove specified metadata, attachments and actions into a new copy. Read its report and review the retained page content for personal information.
Try the CLI ↓ · Run the desktop ↓ · See supported operations ↓
Same app, another mood. This is an actual native window, not a design mockup.
Take a closer look: pages, organization and properties
Find your page. Thumbnails follow the document while the canvas gives you room to read.
Put the pages in order. Open the organizer to rotate, reorder or crop supported documents.
Keep the details right. Edit document properties, including tested Chinese, Japanese and Korean text, then save a verified copy.
These are real macOS captures with synthetic public documents.
npm install --global pdf-editor-offline
pdf-editor-offline --helpStart with one file. Replace input.pdf with a local PDF:
pdf-editor-offline info input.pdf --json
pdf-editor-offline rotate input.pdf --pages 1 --degrees 90 -o rotated.pdf --dry-run --json
pdf-editor-offline rotate input.pdf --pages 1 --degrees 90 -o rotated.pdf --jsonThe first command inspects the document. The next previews a rotation; the last writes a new copy. Pick an unused output name: existing files are not overwritten.
The npm package installs and launches the native Rust CLI; PDF processing stays local. Its installer and launcher need Node.js 22+. Prefer a standalone binary? Download one for your platform and run it directly, without Node.js or a Rust toolchain.
Version 4.0.0-preview.4 passed real binary and global-install checks on macOS ARM64/Intel, Windows x64 and Linux x64/ARM64. It installs the CLI; build the desktop app with the instructions below.
Three more things to try with your own PDF
| You want to… | Run this |
|---|---|
| Read document properties | pdf-editor-offline metadata input.pdf --json |
| See which operations are supported | pdf-editor-offline capabilities --json |
| Check extraction options before choosing pages | pdf-editor-offline extract-pages --help |
Read, organize, add text, draw, fill supported forms and save a separate copy. Each tool has a defined scope; arbitrary existing-text editing, OCR and digital signing are still ahead. The full roadmap shows the remaining work.
Follow the work as it lands: latest commits · native build results · published releases. The table covers current source; published CLI differences are called out below.
Show the full desktop and CLI feature matrix
| Task | Native desktop | Rust CLI |
|---|---|---|
| Read and find | Tabs, zoom, visible-page thumbnails, text sidebar, literal search, light/dark themes | Document info, text extraction, literal search, limited text/geometry comparison |
| Organize pages | Move/reverse pages, rotate, insert blank pages, crop, guarded ranges, split into new tabs, ordered simple-catalog merge, undo/redo | Reorder/reverse/rotate/crop, blank insertion, guarded extract/delete/duplicate, merge and split --every N --output-dir NEW in current source |
| Document properties | Read/edit six standard fields, including Unicode | Read/set/remove Title, Author, Subject, Keywords, Creator and Producer |
| Images | Create PDF pages from supported PNG/JPEG files; place, resize and quarter-turn a new image on an existing page with protected drafts and history | Restricted images-to-PDF conversion; export one PDF page as PNG; current-source add-image-overlay with dry-run and new-copy saving |
| Comments | Bounded sticky-note discovery, guarded add/edit/remove, durable history; supported appearances and standard Text/FileAttachment icons | Add/list sticky Text notes; guarded editing/removal of basic notes |
| New page text | Drag placement, move/eight resize handles, snapping and arrow nudges, numeric controls, covering-font picker, guarded apply and durable undo/redo | add-text-overlay adds bounded Unicode text with an explicit font, rectangle, color and alignment in current source |
| Existing text | Replace eligible standard-face text, adjust size/position/RGB, choose a standard face or embed a covering TrueType font; source-bound history and Save As | inspect-content-text, replace-content-text, set-content-text-properties and source-only set-content-text-font; explicit width changes, dry-run and new-copy saving |
| New drawings | Rectangles, ellipses, lines and bounded freehand paths, colors/paint opacity, snapping, nudges and protected drafts | add-vector-overlay with a strict JSON request, dry-run and fresh-copy saving in current source |
| Visual signatures | Draw, type with a covering font or place a restricted PNG/JPEG; source-bound drafts, durable Undo/Redo and verified Save As | add-vector-overlay, add-text-overlay and add-image-overlay create artwork; no certificate signing or identity verification |
| Forms | Checkboxes/radios, single/multiline text, dropdowns and single/multiple list selections; guarded apply and undo/redo | Discover fields and indexed options; fill-button, fill-text, list-choices and fill-choice in current source |
| Inspect and export | Verified Save As to a new path | Read-only action/attachment/form/layer markers, lossless stream compression, verified fresh output copies |
| Targeted cleanup | Separate unsaved copy, removal report and verified Save As | sanitize removes supported metadata/file/action structures through a full rewrite in current source; includes dry-run and a partial-scope report |
| Permanent text redaction · newer source | Confirmed separate copy under a closed standard-font ASCII profile; original tab retained | redact-text and verify-redaction check the rewritten file bytes; unsupported carriers refuse. Absent from published preview.4 |
| Resume your work | Recorded document/history snapshots, explicit session restore/discard, interrupted-save retry/cancel in current source | Desktop recovery is separate from the CLI |
Supported edits preserve unrelated PDF objects and refuse structures they cannot safely handle. Merge, page subsets, note editing and image conversion have explicit scope restrictions; see the CLI guide. A smaller compressed file is not guaranteed.
Page duplication is available in the
published 4.0.0-preview.4 CLI.
Cropping hides content. Removing metadata or notes can leave old values in the file. None of these operations is secure redaction or private-data erasure. Targeted sanitization removes specified structures and unreachable payloads from a new copy. It preserves page content and can leave other private information; its report explicitly provides no general privacy proof. Permanent text redaction is a separate newer-source workflow for exact ASCII targets within its supported standard-font profile. It removes glyphs and verifies a full-rewrite copy; images and unsupported carriers refuse. See the actual native review. Published preview.4 predates this feature. Original files and recovery copies remain. OCR, cryptographic signing, arbitrary embedded-font editing and high-fidelity Office conversion are not implemented in this preview. Rendering can omit unsupported content; inspect exported documents before relying on them. Signed inputs and successfully decrypted inputs are read-only.
Try the form fixture: buttons preserve existing appearances;
single/multiline text embeds a complete covering TrueType or supported CID-keyed CFF1
font. Missing glyphs and unsupported layouts are refused. Button filling is in the
published 4.0.0-preview.4 CLI, together with supported text and choice generation.
Choice selections use explicit option indices, including when export
values are duplicated. Text and choices require a covering font.
The interface is currently English. These README translations do not imply a localized GUI or complete right-to-left layout support. Offline fonts include tested Chinese, Japanese and Korean glyphs; they do not cover every script.
Install Rust 1.95+ and your platform's native build prerequisites. The app runs locally after building; dependency downloads require a connection on the first build. On Linux, consult the native CI setup for system packages.
git clone https://github.com/OthmaneBlial/pdf-editor-offline.git
cd pdf-editor-offline
export CARGO_TARGET_DIR="${TMPDIR:-/tmp}/pdf-editor-offline-build"
cargo build --release --locked -p pdf-editor-offline-native -p pdf-editor-offline-cli
"$CARGO_TARGET_DIR/release/pdf-editor-offline-native"This keeps the build cache outside the project root. On Windows PowerShell, set
$env:CARGO_TARGET_DIR = Join-Path $env:TEMP 'pdf-editor-offline-build' before
building, then run & "$env:CARGO_TARGET_DIR\release\pdf-editor-offline-native.exe".
Keep going: four CLI commands with the demo PDF
Try the CLI with the included demonstration file:
"$CARGO_TARGET_DIR/release/pdf-editor-offline" info examples/sample_pdfs/demo-basic.pdf --json
"$CARGO_TARGET_DIR/release/pdf-editor-offline" rotate examples/sample_pdfs/demo-basic.pdf --pages 1 --degrees 90 -o rotated.pdf --dry-run --json
"$CARGO_TARGET_DIR/release/pdf-editor-offline" rotate examples/sample_pdfs/demo-basic.pdf --pages 1 --degrees 90 -o rotated.pdf --json
"$CARGO_TARGET_DIR/release/pdf-editor-offline" capabilities --jsonPages start at 1. --dry-run validates without writing.
Choose a new output path: existing files and symlinks are never overwritten.
Use the included demonstration PDF to explore the app before opening your own documents:
- Open
examples/sample_pdfs/demo-basic.pdfin the native desktop. - Search for a word on the page, then open the page organizer and rotate it.
- Undo the rotation, try the dark theme and edit a document property.
- Use Save As with a new filename, then reopen your saved copy.
The desktop guide explains the controls and supported document structures. The gallery above shows actual macOS sessions with this public sample, so you can compare the workspace before building.
PDF operations run on the local machine. The native app uses no remote rendering or cloud conversion service and requires no account. Local processing does not make every PDF safe or prove that hidden information has been removed. Security inspection scope explains what the read-only report can establish.
The current desktop source keeps private local recovery copies, including PDF bytes and paths. Recovery controls let you inspect and discard retained sessions; closing a tab does not securely erase those bytes.
Validation includes Rust tests and independent qpdf/Poppler checks for specific fixtures and supported operations. The CLI evidence records 44 operation checks, real process timings and input/binary hashes, including a generated 1,000-page PDF. Those results do not prove all-document fidelity, desktop responsiveness or a universal speedup.
This is an active native rewrite. Follow the release notes, the next milestones and the implementation status to see what has shipped and what still needs work. The screenshots above show the app; the status documents describe its current limits.
Help shape the next preview: try the supported form workflow, compare a synthetic PDF in another reader or improve one of the nine README translations. Release preparation records the next release's remaining checks. The npm badge above reflects the public registry.
Choose a starting point: use the CLI, run the desktop, contribute a fix or improve a translation.
How the Rust pieces fit together
flowchart LR
Desktop[Native desktop] --> Children[Bounded local child processes]
Children --> Engine[Rust PDF engine]
CLI[Native CLI] --> Children
Desktop --> Recovery[Private local recovery journal]
Desktop and CLI document processing use bounded local children. The released CLI
4.0.0-preview.4 includes this isolation; see CLI controls.
No document upload service is used.
Architecture · Public Rust API
Useful contributions include reproducible PDF issues with synthetic fixtures, renderer comparisons, accessibility testing, translation corrections and small Rust changes. Please keep private documents out of public reports.
cargo test --workspace --locked
cargo clippy --workspace --all-targets --locked -- -D warningsNative status · Desktop guide · CLI guide · Contributing · Support · Security
If you want a PDF editor that works locally, star the repository to help others find it.
MIT licensed. Bundled fonts and dependencies retain their own notices.