pdfcer
PDF engine and scriptable command line for Windows. No network, ever.
- Commits
- 1,476
- Stars
- 0
- Created
- September 3, 2026
The PDF engine, and pdfcer, a command line built on it. Written in Rust, runs from a single folder on Windows, no installer and no registry writes. The long-term goal is feature parity with Adobe Acrobat Pro. It is not there, it is pre-1.0, and docs/FEATURES.md says per surface what works.
The desktop editor moved out into its own project, pdfcer-gui. This repository is the engine and the CLI.
Split out of the earlier pdfce repository on 2026-09-03, carrying its history. The engine went here; the desktop shell went to pdfcer-gui. pdfce still exists and is marked obsolete in its own README, which points at both.
Working today
Opening and rendering. Page operations: merge, split, extract, insert, delete, reorder, rotate. Text extraction and text editing with reflow. AcroForm field creation, editing, filling and flattening, with FDF and XFDF import and export. Markup annotations. Redaction, marked and reviewed before it is applied, either finalizing or preserving an undo.
Bates numbering. PDF/A validation and conversion. Vector object and node editing. Measurement and dimension authoring. Image placement from PNG, JPEG, BMP and TIFF. Printing with page placement, orientation, duplex, copies, and n-up, booklet and poster imposition.
OCR. A scanned page gets an invisible, selectable text layer underneath it. The scan itself is never re-encoded — the picture you had is the picture you keep.
Signatures, both directions. Verification covers integrity and byte-range coverage, with opt-in trust evaluation against an imported Acrobat or Reader trust store: certificate-chain linkage, validity dates at signing time, RFC 5280 CA and key-usage constraints. Signing produces PAdES B-B from a PKCS#12 digital ID, RSA or ECDSA, appended as an incremental update so earlier signatures on the document survive, and verified against itself before the file is written.
Encryption, both directions. It opens RC4 40–128 bit, AES-128, and AES-256 at both /R 5 and /R 6. It authors AES-256 /R 6, sets the eight permission bits, and removes encryption from an owner-authenticated document.
Not built
JavaScript. XFA. Signature timestamps and long-term validation. Digital IDs anywhere other than a .pfx or .p12 file. Revocation checking against a CA. And a long tail of Acrobat’s surface area.
Some of those are “not yet”. Revocation checking is not: it needs the network, and the engine does not have one.
No network
No HTTP client. No TLS stack. No telemetry, no analytics, no crash reporting, no licence check, no update check. Every document is processed on your machine and stays there.
Click a link inside a document and the address is handed to your operating system’s default browser. Your browser makes the request. This program does not.
THIRD_PARTY_LICENSES.md lists every library linked into the binary, so this is a claim you can check rather than one you have to accept.
What you are downloading
Windows 10/11, 64-bit. A single folder, dependencies included, no installer, no registry writes. Unzip it and run it.
It is not code-signed. Windows will show a SmartScreen warning the first time you run it, and again for every new version, because an unsigned program does not accumulate reputation. Updates are manual: download the new zip, replace the program files, keep your userdata folder.
The tests
371 test files, 4,773 test functions.
Two invariants shape the layout they test. pdfcer-core and pdfcer-render never gain a GUI or windowing dependency, which is what keeps a WebAssembly build a shell-crate swap instead of a rewrite, and what makes the GUI and the CLI two independent front ends over one engine. And editing is round-trip and minimal-diff: objects the engine did not touch come back out the way they went in.
1,476 commits. Pre-1.0. docs/FEATURES.md before you assume anything here is finished.
Where this stands
Better at
- No network at all. No HTTP client, no TLS stack, no telemetry, no analytics, no crash reporting, no licence check, no update check. The dependency list in THIRD_PARTY_LICENSES.md is how you check that rather than take our word for it.
- A scriptable command line that is a peer to the GUI rather than a debug tool. Acrobat Pro has no real equivalent.
- Reads password-protected documents other tools produced: RC4 40–128 bit, AES-128, and AES-256 at both /R 5 and /R 6, including the empty-user-password case that opens with no prompt at all.
- Signs as well as verifies. PAdES B-B from a PKCS#12 digital ID, RSA or ECDSA, appended as an incremental update so signatures already on the document stay valid, and self-verified before the file is written.
- OCR that adds an invisible, selectable text layer beneath a scan without re-encoding the scan.
- 371 test files and 4,773 test functions. The engine crates — pdfcer-core and pdfcer-render — never gain a GUI dependency, which is what makes the CLI and any future shell two independent front ends over one engine rather than a program with a scripting mode bolted on.
- docs/FEATURES.md is a per-surface checklist — core, CLI, GUI — updated when a feature lands rather than at release time.
Worse at
- No JavaScript and no XFA.
- Signature timestamps and long-term validation (PAdES B-T, B-LT, B-LTA) are not built; the timestamp round trip belongs to a shell.
- Only a .pfx or .p12 file can sign. Windows-certificate-store and PKCS#11-token digital IDs are not wired up.
- No CRL or OCSP revocation checking. That is a direct consequence of the no-network rule, not an oversight — revocation lookups belong to a shell or to revocation data embedded in the document.
- Windows 10/11 x64 is the supported platform. The code compiles for Linux, macOS and WebAssembly on every change, but those builds are untested and no artifact is published for them.
- The download is not code-signed, so Windows SmartScreen warns on first run, and again for each new version.
- Updates are manual. Download the new zip, replace the program files, keep your userdata folder. It will never update itself.
Pick something else when…
- Adobe Acrobat ProYou need JavaScript, XFA forms, timestamped or long-term-validated signatures, or revocation checking against a live CA.
- A signing service, or Acrobat with a hardware tokenYour signatures have to be timestamped, or your digital ID lives on a smart card or in the Windows certificate store rather than in a file.
- SumatraPDF, or any lightweight viewerYou only need to read and annotate. They have been around far longer, and the editing depth here buys you nothing for that job.