Pdfstudio

PDF Studio

A PDF editor with no backend. It rewrites the file's content stream, in your browser.

▶ Try it live — *no install, no upload, no account*

Use the engine directly. The MCP server installs from npm; the CLI builds from the repo.

npx pdfstudio-mcp --root ./docs --read-only  # MCP: 10 PDF tools over stdio, no API key

npx pdfstudio info contract.pdf # CLI — from a clone, after npm run build:packages

MIT · TypeScript · zero server · the whole pipeline auditable in this repo.

🎬 See it in action (31 sec) — edit text in place, redact for real, add sticky notes, highlight, compare two PDFs, and print. Recorded from the live app; nothing leaves the browser.

*Real recording: the tagline above is retyped live — the original text operators are rewritten in the file, not overlaid.*

Find this useful? A star at the top of the page helps others find it.

---

Quick start

In your browser, nothing to install: navigatorslab.com/pdf-studio

Self host with Docker, one command:

docker run -p 8080:80 ghcr.io/kayforkind/navigatorslab-pdf-studio:latest

→ http://localhost:8080

CLI, from source (three commands):

git clone https://github.com/Kayforkind/NavigatorsLab-PDF-Studio && cd NavigatorsLab-PDF-Studio

npm install && npm run build:packages npx pdfstudio info contract.pdf

---

The problem

Most "free" PDF editors work the same way: upload your contract or your ID to somebody's server, edit three pages, then get hit with a paywall, a watermark, a page cap, or a sign-up screen the moment you press Save. (The honest exceptions are self-hosted tools — but those make *you* run the infrastructure.) Desktop editors that genuinely modify existing text cost a subscription.

The fix

PDF Studio runs 100% in your browser. Your files are opened, edited, and saved on your own machine — there is no server to upload to. And unlike most free editors, it doesn't fake the editing: the Edit tool rewrites the page's content stream itself. The original text is deleted from the file and your replacement is written in as real vector text. Not an overlay. Not a text box on top. The old bytes are gone.

Try it in 30 seconds: open the live app, drop in any PDF, press E, click any line of existing text, retype it.

---

What it does

Screenshots — every claim above, captured from the running app

The full editor — free forever, private by design

Edit hints — every line of the original text is a clickable target

Annotate — underline tool with color and opacity controls

True redaction — covered text is deleted from the file, not painted over

Signature pad — draw with mouse, trackpad, or touch

Signature — stamped onto the page

Forms — values written into the real AcroForm fields

Compare — line-by-line diff of two versions

Export — page ranges, split, stamps, document properties

On-device AI — ask questions about your document, nothing uploaded

Mobile — bottom toolbar, full-width pages

---

How it works

Everything happens in your browser — your file is opened, edited, and saved on your own machine. The pipeline:

1. Open — the PDF loads into browser memory. Nothing is uploaded.
2. Edit — the Edit tool rewrites the page's content stream: the original text is deleted from the file and your replacement is written in as real vector text.
3. Fill & sign — values go into the real AcroForm fields; signatures are drawn on the page. Flatten at export to lock them in.
4. OCR — scanned pages get a text layer from on-device Tesseract, making them searchable, editable, and redactable.
5. Redact — you draw boxes over what must disappear. In the editor these are marked for redaction (hatched): a promise, not a removal. Nothing is deleted yet.
6. Export — the file is rebuilt from scratch. This is where redaction destroys content: fully covered text is deleted from the content streams (recursively through nested form objects); anything that can't be proven removable (partially covered text, images, exotic fonts) forces the page to be rendered to pixels with the boxes burned in and the original content discarded; form values, annotations, accessibility-tree text, metadata, XMP, attachments, JavaScript, and thumbnails under the boxes are scrubbed. Then the finished file is scanned for every covered string across multiple encodings — if anything redacted is still recoverable, no file is delivered; export fails loudly instead of handing you a file that leaks.

After export the app shows a verification report (regions redacted, strings checked, recoverable: zero). Whiteout, by contrast, is visual-only — it covers content without removing it. Use redaction for sensitive data.

Full detail: How it works — docs

---

How it compares

PDF Studio is the zero-setup option that keeps a full editor and never uploads your files.

¹ Smallpdf, iLovePDF, PDF24 and similar. They differ from each other; the row reflects the category, not one product. ² Adobe's published plan, checked 2026-10-08 — prices and plans change.

Full, sourced breakdown: COMPARISONS.md · web version.

The developer difference: redaction here is not a promise, it's a gate. The exporter scans its own output for every covered string in UTF-8, UTF-16BE/LE and hex, through both the delivered bytes and a decompressed re-serialization. If anything is recoverable, no file is produced.

---

Honest caveats

What PDF Studio does not do yet:

• Text editing needs a real text layer. Scanned pages go through the on device OCR first.
• Replacement text uses Helvetica metrics, so on exotic embedded fonts the match is near identical, not glyph perfect.
• The on device AI runs small models (0.5B to 1B). It summarizes your document and answers questions about it well. It is not a frontier model.
• There is no real time collaboration and no cloud sync. Autosave lives in the browser you used.
• Signatures are drawn signatures placed on the page, not certified digital signatures.

---

Privacy — absolute, by architecture

---

Security

Security assessment — 2026-09-28 — overall grade A−. Each claim was checked against the source code. Full assessment: SECURITY_ASSESSMENT.md · agentic (CLI/MCP) addendum · reporting policy.

Residual risks (stated plainly): autosave is plaintext on your disk, so wipe after use on a shared machine; AI model weights come from HuggingFace over TLS without hash verification.