Technical Whitepaper
1. Executive summary
LibertyPDF is a free, browser-based PDF editor for the thirty-second fix: correcting an invoice total, signing a form, redacting an address, reordering pages — then getting on with the day.
No accounts — no sign-up, no login, no subscription tiers. No installs — everything runs in a modern desktop or mobile browser. No watermarks — exports are clean files. No data retention — uploads live in temporary session storage and are permanently deleted about an hour after the last activity, automatically or immediately on demand. Free forever — one developer, one small server, no investors, no ads, no tracking.
Technically it is a Laravel (PHP) application backed by SQLite, with a dependency-free vanilla-JavaScript frontend that renders PDFs with Mozilla PDF.js, and an export pipeline built on the open-source FPDI and TCPDF libraries with qpdf as a normalizer. Scanned pages can be made editable with fully in-browser OCR via Tesseract.js.
2. What LibertyPDF is (and is not)
LibertyPDF is a single-document workspace, not a document-management platform. There are no dashboards, no file libraries, no sharing links, no collaboration. One file opens, gets the whole stage, exports, and disappears.
Capabilities
- Edit existing text in place — click any word, double-click to retype; font, size, weight, style, color, and alignment follow the original.
- Add content — text boxes, images (PNG, JPEG, WebP), shapes, freehand ink and drawn signatures.
- Move, resize, rotate, restyle, layer, duplicate, delete — with full undo/redo, keyboard nudging, and Alt+click selection through overlaps.
- Fillable forms — text fields, checkboxes, and dropdowns detected automatically; entries flatten into the export as real page content.
- Scan-to-text (beta) — OCR turns scanned pages into selectable, movable text, entirely in the browser.
- Highlight, whiteout, redact — marker highlights; reversible white cover-ups; true redaction that rasterizes the affected page on export.
- Pages — add, reorder, insert, delete, merge multi-file PDFs, and split selected pages into a new file.
- Passwords both ways — open protected PDFs (password unlocks one upload, never stored); lock exports with 128-bit AES encryption that opens in every major reader.
- Export — full PDF with real selectable text, single pages, JPG/PNG renders, locked PDFs, and instant server-side deletion on demand.
Published limits (enforced by the application, not marketing)
| Limit | Value |
|---|---|
| PDF upload size | 5 MB |
| Pages per document | 100 |
| Added image size | 4 MB each (plus per-session image quotas) |
| Session lifetime | ~60 minutes after last activity, then auto-deleted |
| Cost / accounts / installs | None — $0, no tiers, no trials |
What it doesn't do
Left out on purpose: user accounts and cloud storage, sharing links (rejected — they break the privacy model), page rotation (architecturally out of reach, §5), and anything that would turn a thirty-second tool into a platform.
3. How it works — the user journey
- Drop. The visitor drags a PDF onto the homepage or taps to browse. Client-side checks mirror the server rules for instant feedback; the server re-validates the actual bytes. A password-protected file prompts for its password, which unlocks that one upload in memory and is never written anywhere.
- Edit. A unique, unguessable editing session opens. Existing text is selectable and retypable in place; new objects are placed, dragged, and styled; pages are organized from the thumbnail rail. Every operation is undoable.
- Save. One click downloads a clean PDF with genuine, selectable vector text — or the Save menu exports a single page, ticked pages, JPG/PNG images, or a password-locked file. A delete option wipes everything immediately instead of waiting for the hourly purge.
On mobile, fingers scroll by default, the Hand toggle switches between pan and edit modes, double-tap edits text, and toolbar zoom replaces pinch-zoom, which conflicts with dragging.
4. System architecture
Browser (vanilla ES modules, no framework)
PDF.js renders pages + extracts positioned text
Geometry engine in PDF points; zoom is CSS only
Interactive overlay: selection, covers, forms, history
| POST /editor/{uuid}/export
v
Laravel 13 (PHP 8.4, SQLite)
Strict server-side validation of every edit operation
Export via FPDI + TCPDF (vector pages, cover patches,
real replacement text, optional AES-128 lock)
qpdf normalization, per-IP rate limits,
temporary storage purged ~1 hour after last activity
Frontend
No framework. The frontend is hand-written ES modules for geometry, history, serialization, and form fields, plus the editor's renderer, overlay, tools, and properties — covered by a Node unit suite. PDF.js renders pages and extracts positioned text; a dedicated overlay layer carries all interactivity so pristine content is never disturbed. Tesseract.js (English models, served locally) performs scan-to-text completely client-side. The editor is styled with Tailwind CSS v4; the marketing site uses a separate hand-written stylesheet so marketing changes can never regress the editor.
Backend
Laravel 13 on PHP 8.4 with a small explicit route surface. SQLite holds sessions, images, statistics, and cache. Every edit operation is re-validated server-side; the client is never trusted. Per-IP throttles guard uploads, exports, images, inserts, compression, and reporting endpoints, alongside byte-level upload validation, security headers, and a report-only Content Security Policy with server-side violation logging.
Storage and lifecycle
Uploads become temporary working copies under unguessable session IDs, outside the publicly served web directory. A scheduled cleanup task purges all session files about an hour after last activity, including orphaned directories — or users wipe everything instantly from the Save menu. Nothing is published, shared, sold, mined, or used to train machine-learning models.
5. Key engineering decisions
- PDF-points-only geometry. All model math is bottom-left-origin PDF points; zoom is a pure CSS transform, making output resolution-independent.
- Vector-first export. Original pages are imported as vector objects, never rasterized: a one-word correction leaves the rest of the file intact.
- Cover-patch parity. Deletions and replacements hide behind opaque covers drawn identically in preview and export.
- No rotation — on purpose. PDF.js reports coordinates in unrotated user space even under /Rotate (proven against calibrated fixtures); rotation would need an extraction rewrite, so it stays documented as out of scope.
- qpdf normalization. Files with cross-reference streams the import library cannot parse are transparently normalized before editing.
- Reader-compatible encryption. Locked exports use 128-bit AES settings chosen because stricter variants are rejected as wrong passwords by Apple and mobile readers.
- Small-server economics. One modest server, SQLite, no background daemons beyond the web stack and purge scheduler — costs stay within what donations cover.
6. Open-source projects used
Versions are those pinned in composer.json / package.json at the time of writing.
| Project | Role | License |
|---|---|---|
| Laravel | Backend application framework | MIT |
| Mozilla PDF.js | In-browser rendering + text extraction | Apache-2.0 |
| Tesseract.js (+ engine, English data) | In-browser OCR for scan-to-text | Apache-2.0 |
| FPDI | Vector PDF page import for export | MIT |
| TCPDF | PDF drawing + password protection | LGPL-3.0-or-later |
| qpdf | Normalization, decryption, compression | Apache-2.0 |
| Vite | Frontend build tooling | MIT |
| Tailwind CSS | Editor utility styling | MIT |
| PHPUnit ecosystem | Backend testing and tooling | MIT / BSD-3-Clause |
| SQLite | Embedded database | Public domain |
TCPDF (LGPL-3.0-or-later) is used unmodified, server-side, as a Composer dependency — invoked at runtime, never forked or embedded into a distributed binary. This paper is not legal advice; consult counsel for license-compliance questions. Fonts and OCR language data are served locally, so no third-party fetch is ever required at runtime: no analytics, ad, or social-widget vendors exist anywhere in the stack.
7. Privacy and security model
- Data minimization: only what editing technically requires — the file and its contents — used solely to render pages and build the download.
- Passwords: unlock passwords exist only in memory for one upload, never logged or stored; export passwords never leave the browser.
- No tracking: two strictly-necessary cookies (session workspace + CSRF token, both expiring within hours). No analytics, pixels, ads, newsletters, or social embeds.
- Transport and storage: TLS everywhere; session files outside the web root under unguessable IDs; byte-level upload validation; rate-limited endpoints; patched stack behind security headers.
- Retention: automatic permanent deletion ~1 hour after last activity; instant deletion on demand; technical logs contain no document contents, filenames, or passwords.
8. Licensing of LibertyPDF itself
LibertyPDF is a small independent free service, operated by a single developer. The service is free to use with no tiers or trials; donations are gifts funding hosting and development — they purchase no features, priority, or influence, per the Terms of Service.
The application's own source tree currently ships without a separate open-source license file; rights in the service's code, design, name, and marks are retained by the operator, and the Terms prohibit scraping, redistribution, reverse engineering, and use of the service to build or train machine-learning systems. All third-party components in §6 remain governed by their own licenses.
9. Operation and sustainability
One developer; every support message is read by the person who builds the editor. Infrastructure is a single modest US-hosted virtual server with automatic TLS renewal, scheduled session purges, and backups. Costs are a server, a domain, and evenings — no billing, no paywalls, no experimentation frameworks, which is itself a reliability strategy. Verification is scripted end-to-end runs, green backend and frontend suites, and every production change deployed and verified live the same day.
10. Where to look next
- Try it: drop a PDF on the homepage.
- Learn it: the Help Center documents every tool, limit, and privacy behavior.
- Legal: Privacy Policy and Terms of Service.
- Support the project: donations buy server time and coffee.
- Report issues: contact — including security reports, which receive priority handling.