BentoPDF, an open-source toolkit for processing PDFs locally in the browser

It's FOSS introduced the open-source PDF toolkit BentoPDF on 10 October; its website lists more than 100 tools. According to its developers, merging, splitting, compressing, OCR (optical character recognition, which turns scanned images into searchable text), encryption and metadata removal all happen in the browser, with no upload to a server. It works straight from the website without sign-up, and the interface is available in Traditional and Simplified Chinese. As of 12 October the latest release is 2.8.8, published on 29 August.

The project's privacy policy says processing is done by JavaScript and WebAssembly libraries running on the user's device and that files are not uploaded, and that the site uses no cookies or analytics. Components such as PyMuPDF, used for compression and PDF-to-Word conversion, are not part of BentoPDF's own source code; the README says the browser downloads them from jsDelivr, a third-party service that distributes code files for websites, when they are used. The OCR page likewise says the OCR engine and selected language packs are downloaded on first use, while the scanned pages and recognized text stay on the device.

The code is published on GitHub under AGPL-3.0, with a separate one-time US$79 commercial license for closed-source products. The project was started by a single developer, and its about page says more than 60 people have since contributed code, translations and fixes. People who would rather not use the website can run it on their own computer or server with Docker, which packages the whole program into a ready-to-run bundle.

Perspective

Online converters send files to their own servers and back, and how long they keep the files depends on each service's policy. iLovePDF's privacy policy says files are deleted within two hours of processing, except for its e-signature service. Smallpdf's privacy notice says it generally aims to delete files from users who are not logged in "within a reasonable period of time" after they were last opened, with each reopening extending that period, while its blog says files from free use are deleted after one hour. The Taipei City Government's Department of Information Technology also told its staff in 2023 to avoid online conversion and encryption services, because there is no way to be sure how such services store and use the data they receive.

BentoPDF's privacy policy says local processing avoids exposure in transit and on a server. Our inference is that trust shifts to the code on the web page instead. When using the official site, you run whatever version the site serves at that moment, and updates do not require the user's consent. Advanced features also load code from jsDelivr, and the official FAQ separately says a few tools that need external data may need a connection.

One of the security advisories the project has published on GitHub describes how importing a crafted workflow file can send the PDF's SHA-256 hash (a digest calculated from the file's contents, not the file itself) to an attacker's server. The advisory lists 2.8.6 and earlier as affected, and as of 12 October it lists no patched version.

Even when processed locally, a PDF can still carry hidden properties such as its author and creation time. BentoPDF's metadata removal tool clears them, and its "Sanitize PDF" tool also removes annotations and scripts, which is worth doing before sharing a file.

Anyone who needs to merge or convert documents containing personal data without uploading them to an online service can use the website directly, and every tool is free. The official FAQ says there is no file size limit beyond what your own computer can handle.

Those who want to pin a version can self-host with Docker as described in the README, which requires installing Docker and using the command line. Networks with no internet access need the README's separate offline deployment steps, packaging the required components on a connected machine first. The privacy policy also says the safety of files depends on your own computer and browser. Our inference is that local processing offers no protection if the computer itself is compromised.

Official cautions about online services in Asia that we found are addressed to public servants. Besides Taipei's notice to city staff, mainland China's Ministry of State Security warned in August 2024 that staff in classified positions must not upload classified documents to the internet or feed them into text recognition features, listing format conversion among the functions of online office platforms; it does not address ordinary users or PDF converters. Japan's 2023 guidance on generative AI from the executive committee (kanjikai) of the Digital Society Promotion Council says government bodies cannot handle confidential information in cloud services that are used just by accepting standard terms, but it does not name file converters. We, a community based in Taiwan, did not find a notice about online converters from Taiwan's Ministry of Digital Affairs or the Executive Yuan, and could not retrieve an official South Korean text, only press coverage of a generative AI guideline.