PQ PDF — Every Tool, Explained

Most deskew tools apply a single global correction. This one gives you a per-page interactive editor before anything is sent to the server.

How auto-detection works

After upload, each page is rendered via PDF.js. Text extraction and PyMuPDF's bounding-box analysis across text blocks, vector paths, and raster images detects the tight content boundary. A 20pt safety margin is added. The result is drawn as a draggable crop box over the rendered page.

The interactive crop editor

What gets sent to the server

Per-page overrides are sent as a JSON array of {page, x0, y0, x1, y1} in PDF display-space points. Pages without manual overrides continue to use server-side auto-detection. The rotation fix bakes the /Rotate flag into the content stream so output pages have rotation=0 in all viewers — aspect ratio and coordinate mapping are preserved for 90°/180°/270° pages via an offset target-rect approach.

Compress PDF controls image DPI downsampling via Ghostscript and optionally applies stream-level recompression via qpdf. A live split-canvas preview renders page 1 as soon as you upload — original on the left, simulated compression on the right — so you can see the visual impact before committing to a download.

Quality presets

Advanced options

What gets compressed — and what doesn't

DPI settings affect raster images embedded in the PDF. Photographs, scanned pages, and screenshots will see the largest reductions — typically 40–90%. Vector content and text are not affected by DPI; they are resolution-independent and remain identical across all presets. A text-only document will see minimal reduction regardless of preset; in that case, enabling stream recompression and metadata stripping provides the most benefit.

Split-canvas preview

As soon as a file is uploaded, page 1 is rendered at full resolution in the browser via PDF.js. The canvas is split vertically — left half shows the original, right half simulates the compressed output at the selected DPI. The preview updates live as you switch presets. This shows the visual quality trade-off before any server processing occurs.

Split PDF supports four distinct split strategies. All modes use Poppler at the binary level — pages are extracted without re-rendering, so fonts, images, and text layers are preserved exactly as they appear in the source.

Split modes

Output

Every Page, Interval, and Interactive modes output a ZIP archive. Custom ranges output a single PDF when one range is specified, or a ZIP for multiple ranges. No re-encoding occurs — output pages are binary-identical to the source pages.

N-up imposition places multiple source pages onto each output sheet. Unlike tools that rasterise pages before imposing them, this tool uses PyMuPDF's show_pdf_page() — pages are placed as live PDF content. Text remains selectable and searchable in the output; images are not re-compressed.

Layouts

Output options

Output page size is selectable (A4, Letter, Legal, A3, or original). Orientation (portrait/landscape) is configurable independently. Pages are auto-scaled to fit each cell while preserving aspect ratio.

Most PDF-to-text converters flatten the document into a single stream of characters, destroying the layout information that makes it useful — headings become plain lines, tables become scrambled text, multi-column layouts interleave content from adjacent columns. pymupdf4llm analyses the document layout before extracting text.

Engine: pymupdf4llm + ONNX

pymupdf4llm is the AI/LLM-optimised extraction layer built on PyMuPDF 1.27 with an ONNX inference backend. It analyses bounding-box positions, font sizes, column boundaries, and text flow to infer document structure before generating Markdown — the same technique used by state-of-the-art document AI pipelines.

Structural elements detected

LLM and RAG use cases

Convert PDF pages to individual image files using Poppler's pdftoppm renderer. A live preview shows exactly what the output will look like at the selected DPI — including the actual output pixel dimensions — before any server processing starts.

DPI options

Output formats

PNG — Lossless. All detail preserved. Recommended for technical documents, forms, and anything with sharp edges or small text. JPEG — Lossy with a configurable quality slider (50–100%, default 85%). Considerably smaller at quality 80+. Recommended for photo-heavy PDFs or when file size is critical.

Live DPI preview with file size estimate

As soon as a file is uploaded, page 1 is rendered in the browser at the selected DPI. The size estimate card shows the actual output pixel dimensions and an estimated file size per page — for example, "1240 × 1754 px per page — ~1.5 MB per page". PNG estimates use ~0.7 bytes/pixel (lossless document content). JPEG estimates scale with the quality slider: at quality 85 the multiplier is ~0.14 bytes/pixel — considerably smaller than PNG. Changing the DPI, format, or quality slider re-runs the estimate immediately so you know exactly how large the ZIP will be before any server processing starts.

Page selection and output

All pages or a custom range (e.g. 1-3, 5, 7-10). Output is a ZIP archive containing one image per page, named sequentially — page-001.png, page-002.png, etc.

PDF/X is the ISO standard for print exchange (ISO 15930). It constrains the PDF feature set to what is reliably reproducible by commercial presses — no RGB images, all fonts embedded, transparency flattened in most variants. This tool converts via Ghostscript's /prepress quality settings with configurable render intent.

PDF/X standards

Render intent — controls RGB → CMYK mapping

What the conversion does

All RGB images are converted to DeviceCMYK. All fonts are embedded and subsetted. Transparency is flattened (PDF/X-1a and X-3). Ghostscript's /prepress output intent is applied. The resulting file meets the ISO 15930 constraint set for the selected variant and is accepted by commercial RIP workflows.

PDF is the most abused document format for delivering malware. This forensics scanner runs 44 independent engines covering every investigative dimension — byte-level signatures, structural integrity, sliding-window entropy, provenance analysis, dynamic behavioural tracing, machine learning anomaly detection with SHAP explanations (IsolationForest + RandomForest + LightGBM), multi-parser differential analysis across six independent parsers, fully offline threat intelligence (URLhaus · MalwareBazaar · ThreatFox · FeodoTracker · OpenPhish — 6.4M+ indicators, zero external API calls), PDF digital signature forensics, phishing detection, AcroForm field forensics (JS triggers on field events, SubmitForm exfiltration targets, hidden fields, password fields, /AA hooks, calc-order chain exploitation), embedded file analysis (magic-byte classification, VBA macro detection, full ZIP archive content listing, nested PDF detection, PowerShell content analysis), and TLSH + pHash + JS-fingerprint campaign attribution. Every indicator is tagged with MITRE ATT&CK technique IDs. Results are presented across 24 analysis tabs: Summary, Threats, Score, a per-engine two-panel browser (click any of the 44 engines for its full findings + structure fields), URLs, Streams, ML/SHAP, Sandbox, Threat Intel, MITRE, Differential Parsing, Polyglot, Phishing, Embedded Files, Signature Forensics, Revision History, Annotations, Metadata, XFA FormCalc, Action Graph, Deep Forensics (engines 34–43), 🤖 AI Forensic Report (Qwen 2.5 1.5B Instruct synthesises all 44 engine outputs into threat verdict, confidence rating, executive summary, key findings, MITRE technique grid, and recommended actions — fully local, structured JSON output, ~15–25 s on CPU), Raw JSON, and a Raw Forensics view showing decoded stream content, JavaScript sources, all indicator contexts, and the complete structure dump. File bytes never leave the server — no hash or data is sent to any external service at any point. Results are forensic-grade: each indicator is documented with engine source, severity, and contextual explanation. File size limit: 10 MB. Threat intelligence research (MalwareBazaar corpus, HP Wolf Security telemetry, Contagio malware archive) consistently shows real-world malicious PDFs are under 5 MB — exploit-kit payloads average 200 KB–1 MB, phishing lures 300 KB–4 MB, dropper PDFs up to 8 MB. The 10 MB cap covers every known threat class with 2× headroom. Scanning larger files requires enterprise deployment.

After a scan, a 9-mode sanitize panel appears. Basic: Flatten to Images (PyMuPDF raster rebuild — maximum safety, destroys all active content) · Strip Active Content (Ghostscript -dSAFER — moderate safety, text usually retained). Advanced — Surgical Cleaning: Remove JavaScript (/JS /AA nullified, layout preserved) · Remove Embedded Files (all /EmbeddedFile attachments) · Remove XFA Forms (/XFA definitions) · Remove Rich Media (/RichMedia /Movie /Sound) · Normalize Structure (qpdf rebuild — collapses incremental updates, disables object streams, decodes filter chains) · Flatten Forms (PyMuPDF bake() renders AcroForm widgets to static content) · Strip Metadata (/Info + XMP stream). All modes produce a new file; the original is never modified.

The 44 engines

Risk scoring

Each indicator contributes base points multiplied by min(occurrence_count, 3) — capped at 3 occurrences per finding type to prevent artificial inflation from a single pattern appearing many times. The Correlation Engine adds weighted bonus points on top for dangerous combinations.

Forensic Console

During the scan a live terminal-style event log streams timestamped events to the browser — upload confirmation, per-engine START/DONE lines, and the final risk verdict. Section dividers separate Upload, Engines, and Results phases. The console can be collapsed or cleared without affecting the scan.

Result banner and risk levels

When all 45 engines complete, a full-width banner appears at the top of the Summary tab showing the risk level, a text explanation, and a score meter bar (0–999):

Statistics grid — 15 fields

Below the banner a 15-cell grid shows key structural stats at a glance. Three cells are clickable and jump directly to the relevant tab. Cells turn red when values exceed safe thresholds:

Scan report — 24 tabs

Results are rendered across 24 tabs. Each tab is independently navigable. Dynamic badges on several tabs update live (threat count, ML %, MITRE technique count, phishing signal score, embedded file count).

Sanitize panel

After every scan (including clean results) a 9-mode sanitize panel appears below the result. Selecting a method sends the session token to the server, produces a new file, and reveals a Download Sanitized PDF button and a Scan the Sanitized File button to re-run the full 45-engine scan on the cleaned output. The original file is never modified.

ML data policy

The ML engine stores a 38-dimensional feature vector per scan (structural statistics: byte counts, entropy values, object type flags, parser discrepancy counts, sandbox syscall anomalies). No file content, no filename, no hash, no IP address, and no PII is stored. Feature vectors are used to retrain the IsolationForest, RandomForest, and LightGBM models every 30 minutes. Model drift detection reports if models have not been retrained in >30 days. Retained indefinitely — not subject to GDPR Article 17 as no personal data is involved. Full details on the Security page.

Standard mode — AES-256-CBC

Password is transmitted over TLS, used to encrypt via Ghostscript with AES-256-CBC, and never stored. Granular permission flags are configurable: print, copy, modify, annotate, form fill, accessibility, and assembly.

PQC mode — client-side quantum-safe encryption

In PQC mode the encryption happens in your browser before the file is uploaded. Key generation uses @noble/post-quantum — a local JavaScript library. The server receives only the encrypted .pqcpdf bundle. Your plaintext file never crosses the network unencrypted.

Available algorithms (31 total, 29 quantum-resistant)

Organised by category. NIST = NIST-standardised primitive.

Signature modes

Visual placement controls (Draw / Type / Upload modes)

First / last / all / custom page selector. Two placement modes:

• Snap grid — 3×3 position grid (left/center/right × top/middle/bottom) for one-click alignment.
• Free placement — drag the signature to any position on the page. Coordinates are transmitted as fractional page offsets (pos_x_pct, pos_y_pct, range 0.0–1.0) and applied with sub-point precision regardless of page dimensions.

A size slider (40–300 pt). Live placement preview composites the signature image onto a rendered page 1 canvas in real time as position and size are adjusted.

Date stamp — an optional date string (up to 30 characters) can be rendered in small text directly below the signature image. Accepts any alphanumeric format, separators, and common date punctuation.

Certificate options

All modes embed a cryptographic digital signature. Certificate source is either an auto-generated ephemeral RSA-2048 self-signed certificate (created per-request, never stored) or a user-supplied .p12 / .pfx file. Signer name (required), email, reason, and location metadata are embedded in the CMS/PKCS#7 signature block.

Workflow

The initiator uploads a PDF, adds up to 10 signers (name + optional email), and chooses a signing order. The server creates an ephemeral workspace (/tmp/esign_{32hex}/, mode 0700) and generates a unique 256-bit secure token per signer. Each token produces a signing URL that can be shared directly — no account is required on either side. The initiator's tracking page polls status every 5 seconds and provides a download link once all signers have completed.

Signing order

Signature placement

Each signer sees a page-1 thumbnail and can place their signature using the same three input modes as the solo Sign PDF tool (draw canvas, typed name, uploaded image). Placement supports the full 3×3 snap grid and free drag-and-drop positioning via fractional page coordinates (pos_x_pct, pos_y_pct). An optional date stamp can be rendered below the signature image.

Cryptographic enforcement — require_crypto

When the document creator enables require_crypto at creation time, signers who attempt to submit without enabling the PAdES-B cryptographic layer receive an error response: "A PAdES-B cryptographic signature is required for this document." This lets initiators mandate that every signature in the workflow is cryptographically verifiable in Adobe Reader's Signatures panel — not just a visual stamp. The certificate source is the signer's own .p12/.pfx or an auto-generated ephemeral RSA-2048 self-signed certificate created per request and never stored.

Workflow management (from the tracking page)

• Add signer — append a new signer to an in-progress workflow; a fresh token and signing URL are generated immediately.
• Remove signer — remove a signer who has not yet signed; their token is invalidated.
• Cancel request — terminate the entire workflow; all tokens are invalidated and the workspace is scheduled for cleanup.
• Return URL / copy link — the initiator can copy a resume link to return to the tracking page from any device.

Storage & retention

All state is stored in the ephemeral temp directory — no database writes, no cloud storage. The workspace has a 24-hour TTL; it is purged on expiry and at create-time cleanup. The final signed PDF is never stored beyond the TTL window. Zero retention applies to the e-sign workflow exactly as it does to all other tools.

Watermark renders directly to the PDF content stream via PyMuPDF — not as a separate annotation layer. The text is permanently embedded; it cannot be removed by deleting an annotation. A live canvas preview composites your watermark text over page 1 in real time as you adjust any setting.

Placement positions (8)

Style controls

Page targeting

Apply to All pages, Odd pages (recto-only in duplex documents), Even pages, or a custom range (comma-separated, e.g. 1-3, 5, 8-10).

Redaction is not the same as drawing a black box over text. A black rectangle drawn on top of text leaves the original text in the PDF file — it can be selected, copied, and searched by anyone who removes or moves the rectangle. Genuine redaction removes the underlying content from the PDF's data structures. This tool uses PyMuPDF's native redaction API, which permanently erases content at the structural level.

Mode 1 — Text pattern redaction

Enter search patterns and the tool finds every matching text occurrence across the document and permanently removes it.

Mode 2 — Canvas region redaction

Draw rectangular redaction areas directly on a rendered preview of each PDF page.

Fill colour and page targeting

Black fill (standard) produces the visible redaction box. White fill is invisible on white backgrounds — useful when removing content without leaving a visible mark, such as stripping header metadata. Page targeting: All pages, Odd, Even, or a custom range.

16 annotation tools

Interactive form builder

Draw AcroForm widgets directly onto the PDF canvas. Supported field types:

Each field has configurable field name, tooltip, required/read-only flags, font size, and text colour. Fields are written as native AcroForm annotations.

Additional features

How edits are committed

All annotation data (positions, colours, text, field definitions) is collected client-side and sent to the server as structured JSON alongside the original PDF. PyMuPDF applies every annotation and permanently flattens them into the page content. The output PDF has no interactive annotation layer — all edits are baked in.

Engine

Tesseract 5 with the LSTM neural network engine (OEM mode 1). The LSTM engine significantly outperforms the older pattern-matching engine on low-quality scans, handwriting, and non-standard fonts.

Output formats

Controls

DPI: 150 / 200 / 300. Higher DPI improves accuracy on dense text but increases processing time. Page segmentation modes (PSM): auto-detect, single column, single block, and sparse text — important for forms and tables where the default auto-detect makes wrong assumptions. Custom page range: up to 100 pages per job.

What comes back

Along with the output file, the response includes an OCR confidence score (per-word Tesseract TSV confidence averaged across all pages), word count, and character count. A live text preview tab in the browser lets you read extracted text without downloading the file.

Compare PDFs performs a page-by-page pixel-level diff between two documents. Because it operates on rendered pixels rather than the text layer, it works equally on text-based PDFs and scanned documents — any visual change is detected, including font substitutions, layout shifts, and image replacements that text-diff tools would miss.

Resolution

Both documents are rendered at the selected DPI before comparison. Higher DPI catches smaller visual differences but increases processing time and output file size.

Sensitivity threshold

Controls the minimum per-pixel difference required to flag a change. Lower values catch more (including compression artefacts); higher values ignore minor differences.

Change map colour coding

Preview and output

Side-by-side canvas previews of both documents render immediately when each file is selected — no upload required for the preview. Output is a single diff PDF with change regions overlaid on every compared page pair.

On upload, the tool reads the PDF's AcroForm dictionary and generates a matching input form in the browser — one input per field, typed to match the field's widget type. Fill the form in the browser, then submit: PyMuPDF writes the values server-side and returns the filled PDF.

Supported AcroForm field types

Flatten-after-fill

When the flatten option is enabled, field values are baked into the page content stream after writing — the output PDF has no interactive form layer. The filled values appear as static text. This is the correct format for archiving, printing, or sharing a completed form — interactive fields in a shared PDF can otherwise be re-edited by any recipient.

No-fields detection

If the uploaded PDF has no AcroForm dictionary, the tool shows a "No interactive fields found" notice immediately rather than presenting an empty form. For PDFs that need form fields added, use the Edit PDF tool's form builder.

The accessibility checker audits a PDF against WCAG 2.1 and PDF/UA-1 requirements. It returns a pass/fail result for each criterion, an impact level (Critical / High / Medium), and an overall letter grade (A–F) based on a weighted score.

The 8 checks

Grading

Each check carries a weight corresponding to its accessibility impact. The weighted pass rate maps to letter grades: A (all critical + high pass), B (minor failures only), down to F. The report lists each check's pass/fail status, the specific WCAG criterion, and the impact level — giving developers and document authors a clear remediation priority order.

Font Inspector

Enumerates every font used across every page. For each font the report shows:

Why non-embedded fonts fail print: When a font is not embedded, the viewer or RIP must substitute it. Substitution changes glyph widths, reflows text, and breaks any layout that depends on exact positioning. PDF/X and PDF/UA compliance both require full font embedding. Non-embedded fonts are flagged in red.

Subset embedding: A + prefix means only the glyphs actually used in the document are included — reducing file size while remaining fully compliant with PDF/X and PDF/UA standards.

Colour Inspector

Audits colour space usage for print-readiness using five detection layers — covering every type of PDF colour content:

The overall verdict — Print-ready (CMYK only, no RGB) or Requires conversion — is shown at the top of the report alongside the per-page breakdown and structured ink coverage table.

PDFs do not store tables as data structures — they store text characters at absolute positions and path objects that may or may not form visible borders. pdfplumber reconstructs table structure from these primitives using two strategies in sequence.

Detection strategies

JSON output schema

Output is a single .json file. The first row of each detected table is treated as column headers; subsequent rows become an array of objects keyed by those headers. Multiple tables per page are each represented as separate entries.

Limitations

Scanned PDFs (image-based, no text layer) are not supported — use OCR first, then extract tables. Tables spanning multiple pages are detected as separate tables. Merged cells are flattened to the flat row/column structure.