pdfcpu
The Go PDF toolkit: a sharp CLI and library for merge, encrypt, validate, and optimize.
About
pdfcpu is a PDF processor written in pure Go, and it ships as both a command-line tool and an importable library, which covers the two ways developers usually want PDF automation. The CLI alone handles an impressive list: merge, split, trim, rotate, n-up layouts, encrypt and decrypt with AES-256 GCM, change passwords, watermark and stamp, extract images and fonts, optimize files, and validate documents against PDF 32000-1:2008. Shell completion works for bash, zsh, fish, and PowerShell.
The project is Apache-2.0 licensed, holds around 8,900 stars, and was pushed three days before this research, with recent work focused on parser robustness and digital signature handling. As a pure-Go tool it deploys as a single binary with no runtime baggage. It is stronger on processing and validation than on creative document generation, so pair it with a layout library if you are building PDFs from scratch rather than manipulating existing ones.
What it can do
- Merge, split, trim, rotate, n-up, and grid page operations
- Encrypt with AES-256 GCM, decrypt, and change owner/user passwords
- Validate PDFs against PDF 32000-1:2008 (PDF 1.7)
- Optimize by removing redundant page resources
- Watermark and stamp with text, images, or PDFs
- Extract images, fonts, content streams, pages, and metadata
- Manage attachments and user access permissions
- Pure Go: single binary, usable as CLI and as a library
Setup
go install github.com/pdfcpu/pdfcpu/cmd/pdfcpu@latest, or download the prebuilt binary from the GitHub releases page.
Prerequisites
Go toolchain for the install method, or just the prebuilt binary. No runtime dependencies.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (verified tier, metrics-v1). Evidence: GitHub API confirms 8,866 stars under Apache-2.0 with a push on 2026-10-13; release notes confirm AES-256 GCM encryption and active signature work; independent Go roundups confirm the CLI-plus-library design. Strengths: single pure-Go binary, broad and genuinely useful command set, permissive license, actively hardened parser. Docked for: (1) focused on processing rather than creative layout generation; (2) digital signature creation still in progress; (3) no independent benchmarks. License: Apache-2.0.
★ 8,866 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 8.0/10
- Maintenance · recency, releases, issue load
- 10.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 9.0/10
- · pdfcpu project; pure-Go PDF processor
- · ~8,866 GitHub stars; push on 2026-10-13
- · Dual interface: CLI and importable Go library
- · Merge, split, trim, rotate, n-up, grid; watermark and stamp
- · AES-256 GCM encryption, decrypt, password changes
- · Validate against PDF 32000-1:2008; optimize; extract images/fonts/metadata
- · Shell completion for bash, zsh, fish, PowerShell
- · Stronger on processing/validation than creative layout generation
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.