PDFE

Active Development

A cross-platform PDF editor and pure-.NET PDF framework, with true content-level redaction, AcroForm editing and authoring, and full PDF 2.0 conformance. The PDF stack is owned end-to-end—parser, writer, and renderer—with no third-party PDF dependencies.

🔗 GitHub Repository

Overview

PDFE began by addressing a critical flaw in most PDF redaction tools: they don't actually redact. Drawing a black rectangle over text is not redaction—the text remains in the PDF structure, trivially extractable with basic tools. This has led to countless security incidents where "redacted" documents leaked sensitive information. PDFE performs true content-level redaction by removing glyphs from the content streams themselves.

That foundation grew into a complete, dependency-light PDF stack. Rather than wrap native PDFium or a commercial SDK, PDFE owns the PDF end-to-end: a pure-.NET parser and writer (Pdfe.Core), a SkiaSharp renderer (Pdfe.Rendering), and a reusable Avalonia viewer control (Pdfe.Avalonia)—a niche the .NET ecosystem largely lacks. Built with C#, .NET 10, and Avalonia UI; over 3,500 tests passing.

Features

  • True content-level redaction - Glyph-level text removal from content streams, not visual masking; verified with external tools (pdftotext, PdfPig) so redacted text cannot be extracted
  • AcroForm editing and authoring - Fill, flatten, click-to-create form fields, and heuristic auto-detect
  • Full PDF 2.0 conformance - CID fonts, color spaces, optional content groups, structure tree, embedded files, page labels, named destinations
  • PDF/UA accessibility tagging - Tagged structure trees, including nested tables and tagged form fields
  • OCR - Scanned-document text via the system Tesseract, with a differential-OCR auditor
  • Reusable, NuGet-packable libraries - Embed Pdfe.Core for parsing/redaction, Pdfe.Rendering for rasterization, or drop Pdfe.Avalonia's PdfViewerControl into any Avalonia app
  • pdfe command-line tool - Batch redaction, search, and verification with regex support
  • Pure managed, MIT-licensed - No third-party PDF dependencies

How It Works

PDFs store text as a series of glyph positioning commands within content streams. PDFE:

  1. Parses the PDF structure to locate text content streams
  2. Identifies the specific glyphs that render the target text
  3. Removes those glyphs from the content stream
  4. Optionally draws a visual indicator (black box) where text was removed
  5. Rewrites the PDF with the modified content streams

The result is a PDF where the redacted text simply doesn't exist—not hidden, not obscured, but gone.

Verification

Trust but verify. PDFE includes verification tools that confirm redaction worked:

pdfe verify document.pdf --redacted "secret text"

This uses multiple extraction methods to confirm the text is truly gone from the document.