Technical Whitepaper

1. Executive summary

LibertyPDF is a free PDF editor for the thirty-second fix: correcting an invoice total, signing a form, blacking out an address, reordering pages — then getting on with your day.

No accounts, so there's nothing to sign up for or log into. No installs — it runs in any modern desktop or mobile browser. No watermarks on your exports. No retention, either: uploads sit in temporary session storage and are permanently deleted about an hour after your last activity, automatically or the moment you ask. And no price tag — no tiers, no trials, no ads, no tracking. It's free because one person builds it and donations cover the server.

Under the hood it's a Laravel (PHP) app on SQLite, with a plain vanilla-JavaScript frontend — no framework — that renders PDFs through Mozilla's PDF.js. Exports are assembled with the open-source FPDI and TCPDF libraries, qpdf irons out the awkward files, and scanned pages can be made editable with Tesseract.js OCR that never leaves your browser.

2. What LibertyPDF is (and is not)

It's a single-document workspace, not a platform. No dashboards, no file libraries, no share links, no collaboration, no "document workflows." One file opens, gets the whole stage, exports, and disappears.

Capabilities

• Edit existing text in place — click any word, double-click to retype; font, size, weight, style, color, and alignment follow the original.
• Add content — text boxes, images (PNG, JPEG, WebP), shapes, freehand ink and drawn signatures.
• Move, resize, rotate, restyle, layer, duplicate, delete — with full undo/redo, keyboard nudging, and Alt+click selection through overlaps.
• Fillable forms — text fields, checkboxes, and dropdowns detected automatically; entries flatten into the export as real page content.
• Scan-to-text (beta) — OCR turns scanned pages into selectable, movable text, entirely in the browser.
• Highlight, whiteout, redact — marker highlights; reversible white cover-ups; true redaction that rasterizes the affected page on export.
• Pages — add, reorder, insert, delete, merge multi-file PDFs, and split selected pages into a new file.
• Passwords both ways — open protected PDFs (password unlocks one upload, never stored); lock exports with 128-bit AES encryption that opens in every major reader.
• Export — full PDF with real selectable text, single pages, JPG/PNG renders, locked PDFs, and instant server-side deletion on demand.

Limits enforced by the application

What it doesn't do

Left out on purpose: user accounts, cloud storage, share links — anything that would turn a thirty-second tool into a subscription.

3. How it works — the user journey

1. Drop. You drag a PDF onto the homepage or tap to browse. The browser checks the file first for instant feedback, then the server re-checks the actual bytes — the page never trusts its own homework. A password-protected file just asks for the password, which unlocks that one upload in memory and is never written down anywhere.
2. Edit. A unique, unguessable editing session opens. The text that's already there is clickable and retypable in place; new objects get placed, dragged, and styled; pages get shuffled around from the thumbnail rail. Everything is undoable.
3. Save. One click downloads a clean PDF with real, selectable text — or the Save menu exports a single page, ticked pages, JPG/PNG images, or a password-locked file. There's a delete option that wipes everything on the spot instead of waiting for the hourly purge.

On a phone, your finger scrolls by default and the Hand button flips between panning and editing. Double-tap edits text (or smart-zooms empty space), pinch-zoom works next to the floating zoom pill, and the big Save bar sits at the bottom.

4. System architecture

Browser (vanilla ES modules, no framework)
  PDF.js renders pages + extracts positioned text
  Geometry engine in PDF points; zoom is CSS only
  Interactive overlay: selection, covers, forms, history
            |  POST /editor/{uuid}/export
            v
Laravel 13 (PHP 8.4, SQLite)
  Strict server-side validation of every edit operation
  Export via FPDI + TCPDF (vector pages, cover patches,
  real replacement text, optional AES-128 lock)
  qpdf normalization, per-IP rate limits,
  temporary storage purged ~1 hour after last activity

Frontend

The frontend is hand-written JavaScript modules — geometry, history, serialization, form fields — plus the editor's renderer, overlay, tools, and properties panel, all covered by a Node unit suite. PDF.js renders pages and pulls out positioned text; a dedicated overlay layer carries every interaction so the pristine page underneath is never touched. Tesseract.js (English models, served locally) does scan-to-text entirely on your device. The editor itself is styled with Tailwind CSS v4; the marketing pages use a separate hand-written stylesheet, so fiddling with the homepage can never break the editor.

Backend

Laravel 13 on PHP 8.4 with a deliberately small route surface. SQLite holds sessions, images, statistics, and cache. Every edit operation gets re-validated on the server — the browser is never taken at its word. Per-IP rate limits guard uploads, exports, images, inserts, and reporting endpoints, on top of byte-level upload checks, security headers, and an enforcing Content Security Policy whose violations get logged server-side.

Storage and lifecycle

Uploads become temporary working copies under unguessable session IDs, kept outside the publicly served web directory. A scheduled cleanup sweeps all session files about an hour after last activity, strays included — or you wipe everything instantly from the Save menu. Nothing is published, shared, sold, mined, or fed to machine-learning models.

5. Key engineering decisions

These are the calls that shaped the whole build — each one earned the hard way:

• PDF-points-only geometry. All model math is bottom-left-origin PDF points; zoom is a pure CSS transform, so output doesn't care what zoom you edited at.
• Vector-first export. Original pages come in as vector objects, never rasterized: fix one word and the rest of the file is byte-for-byte untouched.
• Cover-patch parity. Deletions and replacements hide behind opaque covers drawn exactly the same in preview and export — what you see is what the PDF gets.
• No rotation — on purpose. PDF.js reports coordinates in unrotated user space even under /Rotate (proven against calibrated fixtures); real rotation would need the extraction rewritten from scratch, so it stays documented as out of scope.
• qpdf normalization. Files with cross-reference streams the import library chokes on get quietly rewritten into something it can read before editing starts.
• Reader-compatible encryption. Locked exports use 128-bit AES settings picked because the stricter variants get rejected as wrong passwords by Apple and mobile readers.
• Small-server economics. One modest server, SQLite, nothing running in the background except the web stack and the purge scheduler — cheap enough that donations cover it.

6. Open-source projects used

TCPDF (LGPL-3.0-or-later) runs unmodified, server-side, as a plain Composer dependency — called at runtime, never forked or baked into a distributed binary. None of this is legal advice; if licenses keep you up at night, ask a lawyer. Fonts and OCR language data are served locally, so the app never needs to fetch anything from a third party to do its job.

7. Privacy and security model

The whole model fits in one rule: the server holds the minimum needed to render your pages and build your download, and then forgets. In practice:

• Data minimization: only what editing technically requires — the file and its contents — used solely to render pages and build the download.
• Passwords: unlock passwords live in memory for one upload, never logged or stored; export passwords travel encrypted, are used once to lock the file, and are never logged or stored.
• No tracking: two strictly-necessary cookies (session workspace + CSRF token, both gone within hours). No analytics, pixels, ads, newsletters, or social embeds.
• Transport and storage: TLS everywhere; session files outside the web root under unguessable IDs; byte-level upload checks; rate-limited endpoints; a patched stack behind security headers.
• Retention: automatic permanent deletion about an hour after last activity (never longer than 24 hours); instant deletion whenever you ask; technical logs carry no document contents, filenames, or passwords.

8. Licensing of LibertyPDF itself

LibertyPDF is one person's independent free service. Using it costs nothing — no tiers, no trials — and donations are gifts toward hosting and development, not purchases: they buy no features, no priority, no influence (see the Terms of Service).

The service's code, design, name, and marks stay with the operator. The Terms prohibit scraping, redistribution, reverse engineering, and using the service to build or train machine-learning systems. Third-party components keep their own licenses.

9. Operation and sustainability

Every support message gets read by the person who builds the editor. The infrastructure is one modest virtual server with automatic SSL renewal and scheduled session purges. No billing, no paywalls, no A/B tests, no growth dashboards.

10. Where to look next

• Try it: drop a PDF on the homepage.
• Learn it: the Help Center documents every tool, limit, and privacy behavior.
• Legal: Privacy Policy and Terms of Service.
• Support the project: donations buy server time and coffee.
• Report issues: contact — including security reports, which receive priority handling.