A PDF toolkit that uploads nothing
Most PDF advice sends you to a website. Upload the file, wait, download the result. It works, and it means a stranger's server has your invoice, your lease or your ID scan for however long their retention policy says.
There is a reason to care beyond general paranoia. In March 2025 the FBI's Denver field office warned that some free online file tools exist to harvest what people upload. In July 2024 researchers found two online PDF services leaking 89,062 uploaded files from an open storage bucket, passports and contracts included.
So here is the toolkit I use instead. Nothing in it costs money and nothing leaves the machine. If you do want a browser tool for the occasional job, pick one knowingly. There is a ranking of free PDF editor options with the published limits and watermark policies laid out.
Page surgery: qpdf
# pages 1 to 3 only
qpdf --empty --pages report.pdf 1-3 -- extract.pdf
# merge two files
qpdf --empty --pages a.pdf b.pdf -- merged.pdf
# rotate page 1
qpdf report.pdf --rotate=90:1 fixed.pdf
Fast, scriptable, no GUI. It also flattens annotations, which is how you stop a signature or a comment from disappearing on somebody else's viewer.
Text editing: LibreOffice Draw or PDFgear
Draw opens a PDF and lets you rewrite text. Simple documents come through fine; anything designed gets rearranged. PDFgear is the other free option, with no account and no watermark, which is not the norm in that category. UPDF's own pricing page, for contrast, says its free version stamps a trial watermark on saved files.
Scans: OCRmyPDF
ocrmypdf --skip-text scan.pdf searchable.pdf
It wraps tesseract, keeps the page image and adds a text layer over it. I compared it against running tesseract directly on the same test invoice. Raw tesseract split a line into Total due: and 1,240.00. OCRmyPDF returned Total due: 1,240.00 EUR intact. --skip-text leaves already-searchable pages alone.
Redaction: not the rectangle
Drawing a black box is an annotation. The text underneath stays in the file and copies straight out. This is not theoretical: in January 2019, lawyers for Paul Manafort filed a court document whose blacked-out passages were readable by copy and paste.
On a Mac, Preview does real redaction, removing the text and making it permanent once the document closes. Anywhere else, check that your tool says it removes content rather than covers it.
Signatures and integrity
Run pdfsig file.pdf before you rewrite anything that might be signed. Any edit invalidates a digital signature, because the signature covers the bytes as they were.
What I still open a browser for
Almost nothing. Converting an obscure format, occasionally. And when I do, I check the retention window first, which takes ten seconds and is the only part of this whole post that people skip.