Licences
pdfpix is built out of open-source libraries and sends their code to your browser to do the work. Most use permissive licences. Two of them are copyleft, and each one belongs to a single route: the HEIC decoder is LGPL, and the Print preflight plate renderer is GPL. The list below names each library, what it does here, and where to read its licence or exact source.
| Library | What it does here | Licence | Read it |
|---|---|---|---|
| pdf.js | What it does hereReads and renders PDFs. It is also what checks every result. | LicenceApache-2.0 | Read itFull text |
| @cantoo/pdf-lib | What it does hereWrites PDFs. | LicenceMIT | Read itFull text |
| saxes | What it does hereReads the XML inside a .docx and a .xlsx on the Office routes. | LicenceISC | Read itFull text |
| xmlchars | What it does hereSupplies the XML character tables saxes checks against. | LicenceMIT | Read itFull text |
| @jsquash/jpeg | What it does hereRuns the JPEG encoder in the browser. | LicenceApache-2.0 | Read itFull text |
| mozjpeg, libjpeg-turbo | What it does hereThe JPEG encoder itself. | LicenceThree BSD-style licences, IJG included | Read itFull text |
| harfbuzzjs | What it does hereCuts embedded fonts down to the glyphs a document draws, and shapes Arabic and Hebrew on Word to PDF. | LicenceMIT | Read itFull text |
| Noto Sans and 21 more Noto families | What it does hereDraws Greek, Cyrillic, Hebrew, Arabic, Chinese, the nine Indic scripts, Sinhala, Thai, Lao, Myanmar, Khmer, Ethiopic, Georgian, Armenian and the maths symbols on Word to PDF when the document embeds no font of its own. Records which faces were subset and how. | LicenceOFL-1.1 | Read itFull text and source record |
| OpenJPEG | What it does hereDecodes JPEG 2000 images inside pdf.js. | LicenceBSD-2-Clause | Read itFull text |
| JBIG2, from PDFium | What it does hereDecodes JBIG2 images inside pdf.js. | LicenceBSD, The PDFium Authors | Read itFull text |
| qcms | What it does hereApplies ICC colour profiles inside pdf.js. | LicenceMIT, Mozilla | Read itFull text |
| Compact CMYK profile | What it does hereThe CMYK colour profile used by the PDF to HTML page-layout exporter. | LicenceCC0-1.0 | Read itFull text |
| Adobe CMap resources | What it does hereThe 168 predefined CMaps pdf.js reads to turn a CJK code into a character. One is fetched only when a PDF names it. | LicenceBSD-3-Clause, Adobe | Read itFull text |
| Foxit standard 14 fonts | What it does hereThe ten Type 1 faces pdf.js reads real ascent and descent from when a PDF names a standard 14 face and embeds no program for it. One is fetched only when a PDF needs it. | LicenceBSD-3-Clause, PDFium Authors | Read itFull text |
| Liberation Sans, the pdf.js copy | What it does hereThe four faces pdf.js substitutes for Helvetica and Arial in the same case. Separate from the copy the PowerPoint to PDF route draws with. | LicenceOFL-1.1 | Read itFull text |
| Google BERT Mini | What it does hereSupplies the four-layer base model for private-information suggestions. | LicenceApache-2.0 | Read itSource record |
| ONNX Runtime Web 1.29.0 | What it does hereRuns that detector in a browser worker. | LicenceMIT | Read itFull text |
| UTIF.js | What it does hereDecodes standard and multi-page TIFF files. | LicenceMIT | Read itFull text |
| pako | What it does hereInflates compressed TIFF image data for UTIF.js. | LicenceMIT and Zlib | Read itFull text |
| documents.js | What it does hereWrites the Excel 97–2003 workbook offered by PDF to Excel. | LicenceMIT | Read itFull text |
| fflate 0.8.3 | What it does hereSupplies bounded binary compression code used inside that XLS writer bundle. | LicenceMIT | Read itFull text |
| Zod 4.5.4 | What it does hereChecks the XLS writer model before bytes are created. | LicenceMIT | Read itFull text |
| PDF to XLS writer | What it does hereRecords the pinned source, pdfpix repair, build tools and shipped bundle hash. | LicenceSource record | Read itBuild record |
| saxes 6.0.0 | What it does hereParses the XML inside an .xlsx workbook on Excel to PDF. | LicenceISC | Read itFull text |
| xmlchars 2.2.0 | What it does hereSupplies the XML name character classes that parser checks against. | LicenceMIT | Read itFull text |
| @discourse/heic | What it does hereLoads the HEIC decoder only on the HEIC to PDF route. | LicenceApache-2.0 | Read itFull text |
| libheif 1.19.7 | What it does hereReads the HEIC container inside the route-scoped WebAssembly decoder. | LicenceLGPL-3.0-or-later | Read itExact source |
| libde265 1.0.15 | What it does hereDecodes the HEVC image inside the route-scoped WebAssembly decoder. | LicenceLGPL-3.0-or-later | Read itExact source |
| Poppler 26.02.0 | What it does hereRenders separation plates for Print preflight. Only that route is given its address, and it runs in a worker of its own. | LicenceGPL-2.0-or-later | Read itFull text |
| OpenJPEG 2.5.3 | What it does hereDecodes JPEG 2000 images inside that same Print preflight worker. | LicenceBSD-2-Clause | Read itFull text |
| office2pdf | What it does hereLays PowerPoint slides out and writes the PDF on the PowerPoint to PDF route. Only that route is given its address, and it runs in a worker of its own. | LicenceApache-2.0 | Read itFull text |
| office2pdf, as built | What it does hereThe upstream commit, the five patches and the font archives with their SHA-256 sums, and the toolchain that compiled the WebAssembly this site serves. | LicenceApache-2.0 | Read itSource record |
| Libertinus Serif, New Computer Modern, DejaVu Sans Mono, Liberation Sans, Liberation Serif, Carlito, Noto Sans CJK JP | What it does hereThe typefaces the PowerPoint to PDF route draws slide text with. The route fetches only the ones a deck needs. | LicenceOFL-1.1, GUST Font License 1.0, Bitstream Vera | Read itFull text |
| libeot | What it does hereDecodes the Embedded OpenType fonts a PowerPoint file carries, including MicroType Express, so a deck draws with the typefaces it ships. Compiled into the office2pdf WebAssembly. pdfpix changes three of its files to close memory-safety defects, and the row below carries that patch in full. | LicenceMPL-2.0 | Read itFull text |
| libeot, as changed | What it does hereThe patch pdfpix applies to the pinned upstream archive, in full. MPL-2.0 is copyleft per file, so the changed files are published here. | LicenceMPL-2.0 | Read itSource record |
Licence boundaries
Two well-known PDF engines, MuPDF and Ghostscript, are AGPL v3. Running either one behind a web service obliges the operator to publish the whole service under the same terms. pdfpix uses neither.
The three copyleft components pdfpix does ship stay inside one route each. The HEIC decoder is fetched only after a HEIC or HEIF photo is chosen. The Print preflight plate renderer, which is Poppler and OpenJPEG compiled to WebAssembly, is addressed only from the Print preflight page and runs in a separate worker. libeot is compiled into the office2pdf WebAssembly, which only the PowerPoint to PDF page addresses and which also runs in a worker of its own. No other tool imports or links any of them.
The HEIC decoder and the Print preflight runtime use the released upstream code with no changes. The Print preflight build can be repeated from published sources: the source record names the exact Poppler and OpenJPEG archives with their SHA-256 sums, the Emscripten image by digest, and the adapter and build script that produced the WebAssembly.
libeot is the one component pdfpix changes. MPL-2.0 is copyleft per file and allows that, as long as the changed files stay under the MPL and the changes are published. pdfpix changes three files in the MicroType Express decompressor to close three memory-safety defects. The office2pdf source record names the exact archive and its SHA-256 sum, and the patch itself is published here, so the changed files can be rebuilt from the upstream release.
Where to go next
- Every online PDF tool See every PDF tool on the site on one page, grouped by the job. All free, all in your browser, and your file is never uploaded.
- About Know who builds pdfpix and what it refuses to do.
- How it works Understand what runs in the browser tab, what it checks, and what it never sends.
- Privacy Know exactly what leaves the browser and what never does.