sixteen tools · one payment · yours for good
Fix it, sign it, redact it, send it.
Change the wrong word, merge, split, sign, redact, compress and make a scan searchable — sixteen PDF jobs, done properly, in the tab you already have open. Your contract, your medical letter, your passport scan: they stay on your laptop, because we never see your files. And you buy the whole thing once — $99, every update included, nothing to renew, nothing to cancel.
Nothing to install · No page limits, no daily limits, no watermarks · Every tool free to run on your own documents · Files up to 150–250 MB, because it all happens in your tab's memory
Before you get excited: PDFMod edits the words a PDF already has — click a line, type, and the paragraph closes up around it — but it is nota word processor, and it says no rather than guessing: on justified text, tables and columns, on scans, and on any character your document's own font was never built with. We would rather you read that here than find out afterwards — here is exactly where the line is.
the last time you pay for this
Never think about a PDF subscription again.
Adobe Acrobat Standard is about $155 a year. Smallpdf is about $108 a year. Both stop working the day you stop paying, and neither of them was ever really yours. PDFMod is one payment. Next year there is no invoice, no price rise and no email asking you to confirm your billing details — you just open it and do the job, the same as today.
$99, once
Then nothing, ever. Four weeks of the $25 rental already costs more than owning it, which is deliberate.
Every future update, included
New tools land in the thing you already bought. There is no Pro tier above you.
No trial to forget to cancel
There isn't one to start. Every tool on this site runs on your own documents, for free, before you decide.
Don't take our word for it
open a real PDF, watch the network tab ↓
That is the actual Organise tool, not a video and not a mock-up. There is no sample document in it on purpose — the only demo worth anything here is your own file, in your own browser. Do the whole job in it: drag the pages around, turn the sideways one up, drop the two you don't want. Satisfying yourself that the file went nowhere is free, and always will be.
Sixteen tools, one job each
pick the job, take the file away
Not a tier list you buy your way up. All sixteen come with the one $99 payment — and so does every tool that lands after them. They are grouped below by how often people reach for them, so you can find yours without reading all sixteen.
The everyday seven
start here
7 toolsToo many files, too many pages, too many megabytes — or it has to be a Word file by lunchtime. These are the jobs people arrive needing, and every one of them works on whatever PDF you hand it.
Merge
Several PDFs, or just the pages you name from each, come out as one file in the order you set.
Split
Cut a long document at the ranges you type, or pull out only the pages you actually need to send.
Compress
A file small enough to email, with the same page shown before and after so you can see what it cost.
PDF to Word
A .docx you can type in — with a plain count of what came across, and what didn't, before you convert.
PDF to Excel
The tables as spreadsheet cells, each one drawn over the page for you to check before a cell is written.
PDF to JPG
Every page as a JPG or PNG at the resolution you pick — one file each, or all of them in a ZIP.
JPG to PDF
A pile of photos becomes one PDF in the order you drag them, sideways phone shots turned upright.
Change what is on the page
the document itself
4 toolsSlower jobs, and you will spend longer inside them. Edit is the one to read up on first: it changes the words a document already has, and it says no out loud rather than guessing.
Edit
Fix the wrong word in your document's own font, with the paragraph closing up around it.
Sign
Your signature on the page — drawn, photographed or typed — flattened in and ready to send back.
Organise
Pages in the right order, the sideways ones turned the right way up, the spare ones gone.
Annotate
Highlights, freehand pen, a note, a box — six colours, drawn into the page rather than stuck on top.
The specialist end
why people pay
5 toolsFewer people need these, and they are the reason $99 once beats a free website: the NDA, the passport scan, the consultant's letter — the documents you would not hand to a stranger's server.
Redact
The name out of the file, not covered over — then read back, checked and scored in front of you.
Protect
An AES-128 password on it, or one you know taken off it. Typed here, used here.
OCR
A scan you can search and copy from. The recogniser and its English data run on your machine.
Metadata
Title, author, subject and keywords — read them, change them, or clear the lot out.
PDF to Text
The words as a plain .txt, in reading order or with the columns kept, and a scan sent to OCR.
Your passport scan stays on your laptop
Think about what you actually put through a PDF tool. The tenancy agreement. The consultant's letter. Three months of bank statements for a mortgage broker. The NDA you have not signed yet. Everywhere else, that document is copied onto a machine in someone else's building, and you are asked to be satisfied by a privacy policy and a promise to delete it later.
Here it simply stays where it is. We never see your files. There is no copy of your document on anything of ours, no library holding it, nothing of yours in a breach two years from now, and nothing to delete because nothing arrived. That is not a policy we could quietly change next spring — the section below is how you check it for yourself, in about fifteen seconds, rather than believe it.
What PDFMod will not do
read this bit before you pay
Editing changes the words that are already there. It is not a word processor
Click a line, type, and PDFMod rewrites it using the font already embedded in your document, at the size that line is set in — re-breaking the rest of the paragraph when your replacement is a different length, and showing you every line it would change before it writes any of them. What it will not do is behave like Word. There is no adding a page, no moving a paragraph, no changing the typeface, and no reflow across a column break or onto the next page — that last one is what Acrobat attempts, and it is why Acrobat routinely wrecks tables, headers and signature blocks. It also says no out loud rather than guessing, and tells you which of these it hit: a character your document's own font hasn't got (most PDFs embed only the letters they actually use, so it names the character — "this font was subset to 51 glyphs and Q is not one of them"), justified text with the word spacing baked in, a table, side-by-side columns, a font it cannot write with, and a scan, which has no text in it at all and goes to OCR first. One more, because it surprises people: a hyperlink, form field or highlight is a rectangle on the page rather than something joined to the words, so a re-break leaves it where it was. PDFMod names the ones your change would strand and quotes the words each sits on today, before you press the button. Good on documents that came out of a word processor, thin on documents that came out of a typesetter — and you find that out the moment you open the file, not after you have sent it.
The conversions rebuild your document — they never photocopy it, and none claims perfect formatting
A PDF has no paragraphs, headings, tables or cells — only glyphs at coordinates — so every conversion out of PDF is an inference, and the honest thing is to show you what it found rather than promise a mirror image. PDF → Word groups the glyphs back into paragraphs, headings, lists and tables and puts a count of everything it found — and a plain list of what it could not carry — on screen before it writes the .docx; justified paragraphs come out left-aligned, because that spacing is baked into the file word by word, and rebuilt tables are approximate, so you check the columns in Word. PDF → Excel draws every table it detects over the page, with its column splits, for you to drag, confirm or switch off before a single cell is written; it would rather find nothing and send you to PDF → Text than invent a grid, and it says on the page that rows are text lines and merged cells are flattened. PDF → JPG is plain that print resolution means big files. JPG → PDF turns a sideways phone photo the right way up, and refuses a HEIC by name rather than embed a blank page. PDF → Text offers reading order or a rough monospace column layout, and a scan — which has no text in it — is pointed at OCR rather than saved as an empty file. And all of it goes out of PDF only: Word, Excel and PowerPoint already export a PDF themselves, from File → Save as PDF, and doing it here would mean your document leaving your machine to be laid out on a server, which is the one thing this product will not do.
Sign is a signature, not a digital certificate
It flattens your handwritten mark into the page and hands you a SHA-256 hash of the result. That is what most people mean by signing a PDF. It is not a PKI certificate, a timestamped cryptographic signature, or a DocuSign-style audit trail — and whether it is binding for your document, in your country, is not a question we will answer for you, because it is not our call to make. If a file already carries a real cryptographic signature, Sign, Annotate and Redact turn it away at the door rather than quietly voiding it; the other seven tools tell you plainly, before you commit, that the signature will stop validating — because there, unlike a redaction, nothing pretends the file is unchanged.
It is a browser tool. There is no app to install — for any platform
Editing a PDF on a 6-inch screen is a bad experience and the file-picking story on iOS is worse, so there is deliberately no phone app. There is no Mac or Windows app either, and nothing here is sold on the promise of one: what $99 buys is the thing you are looking at, in any modern desktop browser, working offline once it has loaded. A desktop build is the strongest version of this idea — no server would exist at all — and it is the obvious next step, but it is not part of this release and you should not buy on the strength of it.
OCR is English, and compression is lossy
One language ships today, because each extra one is another 3 MB staged inside the app rather than a call to somebody's CDN. The recogniser is about 6 MB and comes from pdfmod.co the first time you use it — from us, never from a third party, and then it is cached for good. Compression re-encodes the images in a file and cannot be undone, which is why you always get a second file rather than an overwrite. Whenever an image actually was re-encoded you also get the same page rendered both ways, to look at before you throw the original away; when nothing was, there is nothing to compare, and you get the per-image table saying which ones were left alone and why. A document made of text and vectors has nothing to squeeze, and PDFMod says so rather than inventing a saving.
Nothing syncs, because nothing is stored
PDFMod keeps no library, no history and no account data. A file is opened, worked on and downloaded inside one tab, and closing the tab is the end of it. That is a feature here, but it does mean there is no 'my documents' to come back to.
The same instinct runs through the tools themselves. Redact throws away its own output if it finds the words still reachable in it — and when a check cannotrun, it says so in those words rather than showing you a tick. It also draws its black bars wider than you asked, covering the whole line a name sits in unless the rendered page proves a tighter box is safe, and then tells you it did: too much black is something you can see and undo, too little is not. Edit will not substitute a lookalike font to finish a job — when your document's own font has no letter for what you typed it stops and names the letter, because one word in the wrong typeface is the same species of failure as a black rectangle that removes nothing. Compress refuses to hand back a file that isn't smaller. Annotate refuses to write a character the font cannot draw rather than quietly turning it into a question mark. Sign will not hand you a “locked” document whose form still lists a field: it produces nothing instead, and it names the field it could not lock before it starts. Organise tells you afterwards, feature by feature, what an edit actually cost your document. A tool that fails loudly is worth more than one that succeeds unreliably.
for the sceptical reader
Don't believe that. Check it.
Every PDF site on the internet says your files are safe, and each one is asking you to trust a paragraph. This is the same promise in a form you can go and verify — with devtools, or with curl. It is engineering rather than marketing, which is why it is at the bottom of the page instead of the top. Nobody should have to read a security header to buy a PDF tool. It is here because it is the reason the paragraph above is worth anything.
one
There is no server
Not “a server that deletes files after an hour”. None. Reading, editing, rasterising, encrypting, recognising and writing all happen in JavaScript and WebAssembly inside your tab. There is nowhere for a document to be sent, because nobody ever wrote the endpoint that would receive one.
two
The browser enforces it
Every page is served with a Content-Security-Policy containing connect-src 'self'. That instructs your browser to refuse any connection this page tries to open to another origin. Not log it — refuse it. Good intentions can regress in a future release; this cannot, silently.
three
Nobody else is loaded either
No analytics, no error reporting, no session replay, no font CDN, no tag manager. The typefaces are self-hosted at build time. OCR's recogniser is the one thing that arrives later — about 6 MB, the first time you use that tool — and it is staged inside our own build and served from pdfmod.co. Tesseract's own default is to pull it off a public CDN; that would have told a stranger you were about to OCR something, so it is pinned to this origin in code and the policy above would refuse it anywhere else.
Check it yourself
- Open devtools → Network, then put a real document through the demo above. The list keeps growing as you work — each tool's code arrives when you reach for it, and pdf.js fetches the fonts and decoders your particular document needs. Read the domain column rather than the row count: every row says pdfmod.co. Twenty-five requests to run a redaction, when we measured it, and not one of them to anybody else.
- Switch the throttling dropdown to Offline and do it again. It still works, because nothing was waiting on a network.
- Read the response headers on any tool route — devtools, or
curl -I https://pdfmod.co/redact. The policy is right there in the response, on every route, for everyone.
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; worker-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; connect-src 'self'; ← this is the one that matters object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'
The exceptions — both of them, stated plainly: two routes are served with a policy that differs from the block above. We are asking you to go and read the headers, so we are naming both rather than leaving you to find them. /app — the signed-in tool menu, and the screen an installed copy opens on — is served with connect-src widened to name our licence server as well as this origin. That is the only place it is widened anywhere on this site, and it is an allowance rather than a description: as the code stands today that page is a grid of links which asks nothing and calls nothing. It opens no document and no tool runs on it. We would rather tell you the allowance is wider than what currently uses it than have you find that out with curl and wonder what else we rounded off. Every route that opens a PDF carries the strict policy above, unchanged. /demo — the tool embedded further up this page — differs in one direction only: its frame-ancestors also names lifetimeapps.co and the one Vercel hostname that same site deploys to, so our own front page can embed this demo in a frame. That directive governs who may put this page inside theirs, not where this page may send anything; connect-src 'self' holds on /demo exactly as it does on every tool route. Both are in the response headers; go and look.
One price. Then it's yours.
Pay once and the PDF problem is off your list — not rented until next year, not gone the month you forget to renew.
- All sixteen tools, no per-file or per-day limits
- The whole toolkit on every machine you sign in on
- Every future update included
- On-device English OCR, no cloud recogniser
- No cloud account holding your documents
Adobe Acrobat Standard is about $155 a year — roughly $775 over five years, and your contracts still round-trip through somebody's cloud. There is no trial to forget to cancel here, because there is nothing to start: the demo above and all sixteen tool pages are the real thing, free to run on your own documents.
Buy PDFModOnly need it for one job? Rent it for $25 a week and cancel whenever — deliberately worse value than owning, since four weeks already cost more than the $99. It is a pure rental: what you pay in rent does not come off the lifetime price and nothing converts on its own. What five paid weeks do is unlock the lifetime licence at half price — $49.50, whenever you want it.
Fair questions
Where does my file actually go?
Nowhere. It is read by the page you already have open, worked on in memory, and written back out by your browser's download. There is no server on the other end — we did not build one, because the tools do not need one. We never see the file, we never hold a copy of it, and there is no account of yours with your documents in it to be breached in two years' time.
I searched for a PDF editor that doesn't upload my file to a server. Is this that?
Yes, and the wording is worth getting right, because you will notice the difference the moment you use it. You still pick a file and drag it in — that part looks exactly like iLovePDF or Smallpdf, and pretending otherwise would be silly. What is different is the destination. On those sites the file travels to a machine they own and is worked on there. Here it is opened by the page already running in your browser and never goes any further: we never see it, and there is nothing on our side that could. The section above tells you how to confirm that in about fifteen seconds instead of believing us.
How do I check that, rather than believe it?
Open devtools, go to the Network tab, and put a contract through any tool. Watch the column that matters, which is the domain — not the length of the list. The list does keep growing while you work: the code for the tool you touched is loaded only when you touch it, pdf.js fetches the fonts and decoders your particular document happens to need, and OCR pulls its recogniser the first time you run it. Measured on the production build the day this was written: opening /redact costs about twenty requests, handing it a PDF adds a handful more, twenty-five in total — and every single one of them goes to pdfmod.co. Nothing about your file goes out with them; they are the app arriving, not the document leaving. Then read the response headers: Content-Security-Policy carries connect-src 'self', which means the browser itself refuses to let this page open a connection to any other origin — a request to an analytics endpoint would not be blocked-and-logged, it would fail. Two routes carry a policy that differs from the tool routes', and both are named by name in "Don't believe that. Check it." above — including the one whose allowance is now wider than anything that actually uses it.
Can I edit the words in my PDF?
Yes — that is what /edit does, and it is worth knowing exactly how far it goes before you rely on it. Click a line, type the right words, and PDFMod rewrites that line using the font already inside your file, at the size the line is already set in. If your replacement is a different length it re-breaks the rest of the paragraph, rewriting each line where that line already sits, so nothing slides down the page. Every line it would change is listed, before and after, while the file is still untouched. What it is not is a word processor: no adding pages, no moving paragraphs, no changing the typeface, and no reflow across a column break or onto the next page — Acrobat attempts that, which is why Acrobat routinely destroys tables, headers and signature blocks. And it refuses rather than guessing, always saying which thing stopped it: a character your document's font was never built with (it names the character and how many glyphs the font has, because most PDFs embed only the letters they actually use), justified text with the spacing baked in, a table, side-by-side columns, a font it cannot write with, or a scan — a scan is a photograph of a page, so there are no words in the file to change, and it sends you to OCR, which is in this same app and also runs on your machine. It will also not drag a hyperlink, form field or highlight along with the words: those are rectangles on the page rather than things attached to text, so it names the ones your change would strand, and quotes what each is sitting on today, before you commit. Same-length replacements strand nothing.
Can you convert the other way — Word, Excel or PowerPoint into PDF?
No, on purpose, and it is worth saying so rather than leaving a gap. You already own the best tool for that job: Word, Excel, PowerPoint, Pages and Google Docs all export a PDF from File → Save as PDF, and the macOS print dialog does it from almost anything — for free, on your own machine. Converting into a PDF means laying a whole document out from scratch — fonts, pagination, tables — which is reimplementing part of Word, and doing it here would mean your document leaving your machine to be laid out on a server, which is the one thing this product will not do. So PDFMod converts out of PDF only — to Word, Excel, JPG, PNG and plain text — and points you at Save as PDF for the way back.
Is the redaction real, or a black rectangle?
Real. Every page you mark is rasterised — 300 DPI, or the closest a page that size can be drawn at, and the tool reports the figure it actually used rather than the number we would like to advertise — with the redaction painted into the pixels, and the page rebuilt from that image. The original page objects are discarded, not covered. PDFMod then reads its own output back and runs twelve checks on it in front of you. Five are structural and run whatever is in the document: no text layer survives on the rebuilt pages, no text-drawing instructions remain on them, no annotations, links or comments come through, nothing is left in the file's attachments, embedded JavaScript, tag tree, bookmarks, form fields, XMP packet or document properties, and no page object stays in the bytes that the document no longer lists. Two read the pixels: the finished file is rendered again and every rectangle is confirmed solid to the pixel, and each rectangle is confirmed to have stopped on blank paper rather than through a letter. Two search for the words themselves — PDFMod takes the phrase from under your box, so you do not have to type anything — in every page's extracted text, and then in the raw bytes and every decoded stream, in Latin-1, UTF-16 and hex. That last search also undoes the file's own escape codes before it looks, because a PDF is allowed to spell any letter as one: a name written in a document as (Whitm\157re) reads as "Whitmore" in every viewer on earth, and a search that only looks for the eight letters in a row walks straight past it. Ours doesn't; nor past a string broken over two lines with a backslash, nor past a hex string with spaces in it. The tenth check is the one that keeps the other two honest: it states, before them, whether the areas you marked actually held text PDFMod could read, because a search that never ran is not a search that came back clean. The last two ask the same question of ink rather than text: whether what you marked was ink PDFMod could read at all, and whether anything anywhere in the file is writing it cannot — a name converted to outlines, a wordmark, a font that hands back no characters. Those two exist because a page can carry letters that no text search will ever see. Now the part worth reading twice, because two different things happen. A check that FAILS means no download link at all: the file is thrown away in front of you and the report names the line that failed. A check that could not RUN is never counted as one that passed, but it does not stop the download either — on a scan there are no words under your marks to search for, so those two lines read 'nothing to check', in exactly those words, the report is headed 'Rebuilt — and only partly checked', the untested lines are listed out, and you get the file under that narrower guarantee. (Where there was some text but too little to search a whole document for, they read 'not checked' instead — same rule: not a tick.) There is a second version of exactly the same rule. A rebuilt page is an image, and every one of those checks reads text — so anything that got onto the paper without passing through a text layer was never in scope for any of them: a photograph, a stamp whose artwork is one, a scanned signature, a name drawn as outlines rather than typed. Where a page you marked carries something like that, the report adds a line naming what it found and which page, marks it 'not checked', and heads itself 'Rebuilt — and only partly checked'. Your rectangles were still painted and still read back from the finished pixels; what it will not do is call the whole page clean on the strength of the words it could read. That is deliberate. A scan is exactly the thing people most need to redact, and refusing it would send them to a tool that draws a black rectangle and tells them nothing. It also refuses encrypted, XFA and already-signed files up front rather than half-working.
Why is the black bar wider than the word I searched for?
Because the alternative is worse, and we have the scars. Search a name and PDFMod covers the whole line of text it sits in, not the name alone, unless the page has been rendered and the ink itself proves — three separate ways — that a smaller rectangle covers every pixel of those letters and nothing else. Two earlier versions computed the tight box from the font's own numbers instead. Both were wrong on ordinary files, one of them leaving 'ORE' of a surname legible, and both reported success. A rectangle that is too big is ugly and obvious and you can delete it before anything is written; a rectangle that is too small leaks and is invisible. So the ugly one is the default, and the tool tells you in words which of your marks came out that way. Two more things the search does that you would want it to: it reads the whole document as one piece, so a name broken across a page break is still found, and it searches comments and filled-in form fields too — their text is in the file and in front of you, but it is not in any page's text, so a tool that only reads the page will swear the name is not there. Those get marked at the annotation's own declared box. And if the phrase is provably in the file but PDFMod cannot work out where on the page it is, it marks nothing and says so, rather than blacking out possibilities.
What is free, and what does the $99 actually buy?
Every tool on this site runs without a licence and without an account. Open a real file, do the real job, read the whole report, watch the network tab — none of that is a trial, none of it is a crippled preview, and nothing comes out with a watermark on it. What $99 buys is the toolkit itself, once: sixteen tools today, every tool and every improvement that lands after them, on every machine you sign in on, with nothing to renew and no Pro tier sitting above you. We would rather you put your own contract through it and then decided, because the only claim this product sells on is that your document never reaches us — and that is not a claim anybody should take from a paragraph on a website.
Do I need an account?
Not to use the tools — the demo on this page and all sixteen tool pages are the real thing and never ask who you are. You need one to buy, because that is how your licence finds you on your next machine. Signing in talks to our licence server and nothing else; it is never told anything about a document, because by then the document has been and gone.
Why pay, when iLovePDF and Smallpdf are free?
Because free is not the comparison. Those tools send your file to a server you do not control, and the free tier is paid for by that. If you are shuffling holiday photos, use them. If it is an NDA, a medical letter, a passport scan or a board pack, the question is not what the tool costs — it is where the document went. And their paid tiers are not one-off: Smallpdf is about $108 a year, Adobe Acrobat Standard about $155 a year, and both stop working the day you stop paying. This is $99, once, and then it is yours.
Does it work offline?
Yes, with two footnotes worth reading. The app installs a service worker that caches all sixteen tool pages and the whole tree of code they load — not only the page you happened to open — so the toolkit keeps working with the network off, and since no operation needs a server, nothing was waiting on one anyway. The first footnote is OCR: its recogniser and English data are about 6 MB, and handing that to everyone who might never open that one tool is exactly the download-you-didn't-ask-for this product refuses to do. Run OCR once while you have a connection and it is cached like the rest. The second is smaller and rarer: pdf.js keeps its character maps, standard fonts and JBIG2/JPEG2000 decoders in a folder of their own — 1.6 MB spread over hundreds of files that almost no document needs — so those are fetched only when a file actually calls for one, and kept from then on. Both come from PDFMod's own origin, never a third-party CDN.
What if LifeTime Apps disappears?
The tools keep working — they are code running in your browser and they never called home to begin with. There is no library to lose, because we never held one, and your PDFs are on your disk in a format nobody owns. The licence does not become a trap either: a lifetime licence is confirmed with our server once, on each machine you sign in on, and then cached there for good — never re-checked, never expiring, so saving files goes on working with the licence server switched off or gone. A weekly rental does lapse when it runs out, plus a fortnight's grace, because that is what renting is.
bought once, and then it is just yours
Open the contract. Do the job. Nothing left the room.
Or start with a tool — nothing to install, nothing to renew, no watermark.