02 — Market survey: every tool family that works on PDF, and what we take from it
Columns: Take = = match the capability · > surpass it (with the measurable
criterion) · 🔬 adopt as oracle · 🚫 out of scope with reason. Licences are as known in
2026-09 and must be re-read before any compatibility or shim decision.
2.1 Reading and rendering engines
| Tool | Licence | Strength | Take |
|---|---|---|---|
pdfium (Google; Chrome, Android PdfRenderer, Edge legacy) |
BSD-3 | largest deployment; stable C API FPDF_*; XFA build option |
> rendering; drop-in FPDF_* shim (F-015); 🔬 via pypdfium2 (already) |
| MuPDF / mutool / mupdf.js (Artifex) | AGPL-3 / commercial | fast, small, official WASM | >; 🔬 already; its dual licence is the market gap (07-brainstorm.md §10) |
| poppler / xpdf (Evince, Okular, LibreOffice import, cups-filters) | GPL-2/3 | everywhere on Linux; poppler-utils; poppler-glib/Qt APIs | >; 🔬 already; CLI-compatible pdftotext/pdftoppm/pdfinfo/pdfimages/pdfsig and a poppler-glib-shaped API for GNOME/KDE viewers (F-015) |
| pdf.js (Mozilla; Firefox, countless web apps) | Apache-2.0 | web viewer of record | >; 🔬 already; WASM target replaces it in our own products (F-050) |
| Ghostscript (Artifex) | AGPL-3 / commercial | PostScript+PDF RIP, ps2pdf, print drivers, colour management |
🔬 already (-dUsePDFX3Profile, tiffsep, pnggray); CUPS filter replacement (F-053); PostScript interpreter = far future |
| Skia PDF backend, Cairo PDF | BSD-3 / LGPL-2.1+MPL | vector output from browsers and GTK | = canvas-style drawing API (F-030) |
Apple PDFKit/Quartz, Windows.Data.Pdf, Android PdfRenderer (pdfium) |
proprietary / BSD | OS viewers and APIs | = fidelity; 🔬 optional (Preview.app on the Mac) |
| Commercial SDKs: Foxit SDK, Apryse (PDFTron), Nutrient (PSPDFKit), Adobe PDF Library (Datalogics), PDF-XChange Core, Aspose.PDF, Syncfusion, LEADTOOLS, GdPicture, 3-Heights (PDF Tools AG), Qoppa jPDF, BFO, PDFlib, Solid Framework, Debenu/Foxit Quick PDF | commercial | full feature range, multi-language SDKs, embeddable viewers, servers | = the full functional envelope plus bindings — this is the market the proprietary licence targets |
| PDFBox (Apache), OpenPDF (LGPL/MPL), iText (AGPL/commercial), PdfPig (Apache), PDFsharp/MigraDoc (MIT), PdfClown (LGPL) | various | the JVM/.NET workhorses | = high-level API shape; 🔬 PDFBox corpus (already), iText test resources (to add); JVM/.NET bindings (F-014) |
| pdfcpu (Apache), lopdf/pdf-rs/printpdf (MIT) | Apache / MIT | Go and Rust | = pdfcpu CLI surface; 🔬 corpus already |
| pypdf (BSD), pikepdf (MPL, qpdf), PyMuPDF (AGPL), pdfminer.six (MIT), pdfplumber (MIT), borb (AGPL/commercial) | various | Python — where most PDF automation is written | Python binding with a familiar API (F-013) |
| pdf-lib, pdfkit, jsPDF (MIT), muhammara (Apache), react-pdf, pdfme | MIT / Apache | client-side JavaScript creation | napi-rs + WASM (F-011/F-012) |
2.2 Generation and layout
| Tool | Licence | Strength | Take |
|---|---|---|---|
| ReportLab (+PLUS), fpdf2, TCPDF, mPDF, dompdf, FPDF | BSD / LGPL / GPL | programmatic generators per language | = document builder (F-030): shaped text, tables, images, vector, tagged output by default |
| WeasyPrint (BSD), Prince (commercial), PagedJS (MIT), Vivliostyle (AGPL), PDFreactor, DocRaptor, wkhtmltopdf (LGPL, unmaintained), Puppeteer/Playwright PDF, Gotenberg | various | HTML+CSS → PDF (invoices, reports) | 🧭 a full CSS engine is a separate product; = CSS paged-media subset on apdf-layout (06-decisions.md D-9) |
| Typst (Apache), LaTeX (pdfTeX/LuaTeX/XeTeX; LPPL/GPL), Apache FOP, Antenna House (commercial), groff, Pandoc, Quarto, Asciidoctor PDF | various | typesetting | 🔬 pdfTeX/LuaTeX as the oracle of writer quality (font subsetting, tagging, metrics); = hyphenation (ADR pending), UAX #14 |
| InDesign, QuarkXPress, Affinity Publisher, Scribus (GPL), LibreOffice (MPL), Word, Google Docs, Canva | producers of real-world PDFs | their output fills the corpora | 🔬 producer-specific quirks catalogued (Producer string → known deviations table) |
| Report engines: JasperReports, BIRT, Crystal Reports, SSRS, Oracle BI Publisher | various | enterprise reporting → PDF export | = our writer as their PDF backend (JVM/.NET bindings) |
2.3 Command-line manipulation and utilities
| Tool | Licence | Strength | Take |
|---|---|---|---|
| qpdf | Apache-2.0 | structural reference: QDF, --json, linearisation, encryption, page ops |
🔬 already; = QDF mode, --json compatible output (F-023) |
| cpdf (Coherent Graphics) | AGPL / commercial | the most complete CLI on the market (200+ operations) | = CLI parity target for apdf (F-015) |
| pdftk / pdftk-java | GPL | merge, FDF forms, Bates, stamps | 🔬 already (FDF); = all its verbs (Phase 0 AE/AI) |
| poppler-utils, mutool, pdfcpu, img2pdf, pdfjam, PDFsam (AGPL basic), PDF Arranger (GPL), Stirling-PDF (MIT), PDF24, Sejda | various | personal operations: merge, split, compress, convert, rotate, crop | = all in apdf and in the viewer (F-050) |
| iLovePDF, Smallpdf, Adobe online, CloudConvert, pdfcrowd | SaaS | consumer funnel | = pdf.asklera.fr showcase (F-052) |
| exiftool, pdfinfo, pdfsig, pdfdetach, pdfresurrect | Perl Artistic / GPL | metadata, signatures, attachments, revision history | 🔬; = apdf info/meta, revision time machine (F-020) |
2.4 Validation, preflight, conformance
| Tool | Licence | Strength | Take |
|---|---|---|---|
| veraPDF | GPL/MPL dual | industry PDF/A and PDF/UA validator; corpus; profiles | 🔬 already; > glyph level, TS 32005; 0 disagreement target (Phase 0 AF) |
| JHOVE (PDF-hul), DROID/PRONOM, Siegfried, Apache Tika | LGPL / BSD / Apache | archives and libraries: well-formedness, format identification, metadata | 🔬 to add (F-042) |
| callas pdfToolbox / pdfaPilot, Enfocus PitStop, Adobe Acrobat Preflight, 3-Heights Validator, Datalogics PDF Checker | commercial | PDF/X preflight, fix-ups, profiles | = linter with suggested fixes (F-021), preflight (F-041); 🔬 trial versions as calibration (founder decision 2026-09-13) |
| PAC 2024, axesPDF/axesCheck, CommonLook, Equidox, Grackle, Foxit Compliance | freeware / commercial | accessibility | > (PDF/UA done); = guided remediation (F-043) |
| Arlington PDF Model + TestGrammar | Apache-2.0 | machine model of ISO 32000-2 | 🔬 already; = contribute our found deviations (07 §5) |
| OSS-Fuzz (pdfium, poppler, mupdf, qpdf, ghostscript are enrolled) | — | continuous public fuzzing | = our own continuous fuzzing (Phase 0 AH, F-065) |
| eCTD validators (Lorenz eValidator, GlobalSubmit, Extedo), FDA/EMA technical conformance guides | commercial / public | pharma PDF profile checks | = eCTD PDF profile in the linter (03b §L) |
2.5 Signature and trust
| Tool / standard | Licence | Strength | Take |
|---|---|---|---|
| pyHanko | MIT | PAdES B-B/T/LT/LTA, validation, LTV, TS 32004, PKCS#11 | 🔬 already |
| DSS — Digital Signature Service (European Commission) | LGPL-2.1 | the eIDAS validation reference: LOTL/TSL, AdES levels, ETSI TS 119 102 procedures | 🔬 to add (F-034) |
| OpenSSL cms/ts, Bouncy Castle, EJBCA/SignServer | Apache / MIT / LGPL | CMS, TSA, PKI | 🔬 openssl already; Bouncy Castle to add for PQC (F-033) |
| OpenSC (opensc-project) | LGPL-2.1 | PKCS#11 + PC/SC drivers for 100+ cards (PIV, CAC, Belgian eID, EstEID, DNIe, CNS, OpenPGP card, YubiKey PIV, Feitian, SafeNet…) | 🔬 the oracle for the generic smartcard layer (F-036); pkcs11-tool, opensc-tool, pkcs15-tool |
| Vendor middlewares: Cryptolib CPS (FR), gematik Konnektor/HBA (DE), BEID (BE), Web eID/DigiDoc (EE), AusweisApp/eCard-API (DE), CryptoPro CSP (RU), CFCA/GM drivers (CN), emSigner/ePass (IN), ITI Assinador (BR) | various | national card ecosystems | = generic PC/SC + PKCS#11 first, then per-card profiles (ISO 7816-15, IAS-ECC, PIV, CAC, EstEID…) as modules; libcps-rs is one module among them |
| CSC API v2.2 (2025-11-06), EUDI Wallet ARF, OAuth 2.0 | open | remote qualified signing | = CSC client (F-034) |
| Platforms: Adobe Sign, DocuSign, Yousign, Universign, Docaposte, Certeurope, Ascertia SigningHub/ADSS, GlobalSign DSS, Entrust, Swisscom AIS, D-Trust sign-me, Namirial, InfoCert GoSign, Aruba, Intesi, Cryptomathic, Utimaco, LibreSign, Xodo Sign | SaaS / commercial | signing flows | = embeddable signing component with an external-signer (hash → signature) abstraction so any HSM/KMS/cloud signer plugs in (AWS KMS, Azure Key Vault/Managed HSM, GCP KMS, Thales Luna, nShield, Utimaco, CloudHSM) |
2.6 Encryption, security, forensics, sanitisation
| Tool | Licence | Strength | Take |
|---|---|---|---|
| qpdf / pdftk / Acrobat encryption | — | R2–R6, public-key | ✅ done and beyond (RC2-40, AES-GCM, downgrade named) |
Microsoft Information Protection (/Filter /MicrosoftIRMServices, .ppdf), Adobe LiveCycle Rights Management (/Adobe.APS), FileOpen (/FOPN_foweb), Adobe ADEPT (/EBX_HANDLER), Locklizard, Vitrium |
proprietary | enterprise/e-book DRM handlers | = MIP labels (XMP MSIP_Label_*) read/write and MIP-encrypted PDF detection; decryption only with the vendor SDK/keys — 🚫 no DRM circumvention |
| peepdf, pdfid/pdf-parser (Didier Stevens), origami (Ruby), PDFStreamDumper, pdfresurrect, pdfxray | GPL / MIT | malicious-PDF analysis: JS, actions, hidden objects, revisions | = forensic mode of the inspector (F-025) |
| CDR vendors: OPSWAT Deep CDR, Votiro, Glasswall, Sasa, Forcepoint Zero Trust CDR | commercial | Content Disarm & Reconstruction for cross-domain gateways | > CDR by construction: rebuild a PDF from a validated object model (F-025 apdf scrub --rebuild); guidance: NSA "Inspection and Sanitization Guidance for PDF", NCSC "Safely importing data" |
| Sandboxes/YARA/VirusTotal, Cuckoo/CAPE | — | detection | = YARA-compatible indicator export |
| Research: PDFex (Müller et al., CCS 2019), Shadow Attacks (NDSS 2021), "Processing Dangerous Paths" (NDSS 2021), signature wrapping/USF/ISA (S&P 2019), pdf-insecurity.org; FORCEDENTRY (CVE-2021-30860, JBIG2 zero-click) | papers / CVEs | attack classes on encryption, signatures, decoders | = hardening report replaying every class (F-025, 07 §4); JBIG2/JPX decoders fuzzed first (Phase 0 AH) |
| Acrobat "Remove Hidden Information", Acrobat Redact, Adobe Sanitize | — | GDPR/RGPD clean-up, true redaction | = apdf scrub, apdf redact with destruction report (F-045) |
2.7 Interactive editors and viewers
| Tool | Licence | Strength | Take |
|---|---|---|---|
| Acrobat Pro/Reader, Foxit Editor/Reader, PDF-XChange, Nitro, Kofax Power PDF, Master PDF Editor, PDF Studio, PDF Expert | commercial | in-place text edit, forms, review, OCR, compare, Bates | = full editing surface (Phase 0 AE + F-050) |
| Okular, Evince, SumatraPDF, Zathura, Skim, Preview, Edge/Chrome/Firefox, Xodo, Kami, Drawboard, GoodNotes/Notability | free/commercial | reading, annotation, stylus | = native (egui) and WASM viewer (F-050) |
| Bluebeam Revu (Nemetschek) | commercial | construction/AEC markup leader: measurement, layers, Studio sessions | = measurement dictionaries (/Measure, /Viewport, /PtData), OCG layers with /Intent /Design, AEC markup sets (03b §P) |
| LibreOffice Draw, Inkscape, Illustrator, Affinity | — | vector editing of PDF pages | = SVG import/export, object-level editing (F-030) |
| Litera Compare, Draftable, Workshare, Adobe Compare | commercial | legal redlining | = structural + textual + visual diff (F-024) |
2.8 OCR, scanning, scan compression
| Tool | Licence | Strength | Take |
|---|---|---|---|
| Tesseract, OCRmyPDF (MPL), EasyOCR, PaddleOCR, docTR, NAPS2 | Apache / MPL | free OCR, invisible text layer | 🧭 bind or build (D-6, F-054); OCR is an external engine |
| ABBYY FineReader Engine, Kofax OmniPage, Google Document AI, AWS Textract, Azure Document Intelligence | commercial / cloud | premium OCR | 🚫 cloud; = pluggable OCR interface |
| LuraTech/Foxit PDF Compressor, ABBYY, CVISION, Kofax | commercial | MRC (Mixed Raster Content: JBIG2 mask + JPX background/foreground) | > MRC compression — we own JBIG2 and JPX encoders (F-046) |
| TWAIN PDF/raster, VueScan, ScanSnap, JIIMA-certified scanners (JP) | — | scan → PDF | = PDF/raster read/write (ledger pdfraster absent) |
2.9 Structured extraction and "document AI"
| Tool | Licence | Strength | Take |
|---|---|---|---|
| pdfplumber, Camelot, Tabula, pdfminer, PyMuPDF4LLM | MIT / AGPL | tables, positioned words | = table extraction (F-044) |
| Docling (IBM, MIT), Marker (GPL/commercial), Nougat, Unstructured (Apache), LlamaParse, GROBID (Apache), CERMINE, Adobe PDF Extract API | various | PDF → Markdown/JSON for RAG; layout by ML models | > structure-first extraction: our reading order is proven (UA, bidi) where they guess; Markdown/JSON with provenance (F-044) |
| Benchmarks: OmniDocBench, DocLayNet, PubLayNet, PubTabNet, FinTabNet | data | layout ground truth | 🔬 to add as extraction oracles |
| Rossum, Klippa, Mindee, Veryfi, Sensible, Parseur | SaaS | invoices/receipts | = structured e-invoices (03b §H) make extraction unnecessary where the XML exists |
2.10 Prepress, print production, output management
| Tool | Licence | Strength | Take |
|---|---|---|---|
| callas pdfToolbox, Enfocus PitStop/Switch, Adobe Preflight, Quite Imposing | commercial | preflight, fix-ups, imposition | = preflight, imposition, fix-ups (F-041) |
| Kodak Prinergy/Preps, Heidelberg Prinect, Esko (ArtPro+, Automation Engine), Agfa Apogee, Xerox FreeFlow, EFI Fiery, Harlequin RIP (Global Graphics), Adobe PDF Print Engine, Caldera, Onyx | commercial | production workflows, RIPs | = RIP-grade separations bit-exact vs gs tiffsep, trapping, screening (F-041) |
CUPS / cups-filters (pdftopdf, pdftoraster, pdftops), OpenPrinting |
Apache / GPL | Linux/macOS print pipeline (poppler/mupdf/gs today) | > apdftoraster/apdftopdf filters (F-053) |
| AFP/MO:DCA, IPDS, PCL/PCL-XL, PostScript, XPS/OpenXPS (ECMA-388), Metacode: Compart DocBridge, Crawford, Solimar, Xerox, ISIS Papyrus | commercial | mainframe/enterprise output streams | = AFP ↔ PDF and XPS → PDF converters (03b §R) — a large, under-served enterprise niche |
| CCM: Quadient Inspire, OpenText Exstream, Smart Communications, PDFlib PPS, XMPie, HP SmartStream | commercial | variable data (PDF/VT) | > PDF/VT written; = VDP generator (data → DPart) (F-041) |
| Ghent Output Suite, Altona, ECI, FOGRA, IDEAlliance/PRINTING United, GWG, PDF/X-Ready, CIP4 JDF/XJDF | data / standards | print test and exchange | 🔬 Ghent already; 🧭 Altona licence; = JDF/XJDF job-ticket read |
2.11 Accessibility
| Tool | Strength | Take |
|---|---|---|
| PAC 2024, axesPDF, CommonLook, Equidox, Grackle, Acrobat autotag/checker, Crawford, allyant, Word checker | verification, remediation, autotag | > verification done; = autotagging from detected layout, guided remediation, reading-order simulation, VPAT/ACR report generation (F-043) |
2.12 Archival and preservation
| Tool | Strength | Take |
|---|---|---|
| JHOVE, veraPDF, DROID, Siegfried, Archivematica, Preservica, Rosetta, VITAM (French national archives, open source), E-ARK tools | identification, validation, SIP/AIP packaging | 🔬 JHOVE/DROID/VITAM; = PDF/A conversion at scale (F-042), SIP packaging hooks (SEDA, E-ARK CSIP, BagIt) |
| Foxit/LuraTech, callas pdfaPilot, 3-Heights Document Converter, Solid, Adlib | commercial | mass conversion |
2.13 Forms and document workflow
| Tool | Strength | Take |
|---|---|---|
| Adobe AEM Forms / LiveCycle (XFA), SAP Interactive Forms by Adobe (XFA in SAP ADS), Acrobat Prepare Form, Foxit, PDF-XChange | form design, XFA in the enterprise | = form designer (AcroForm + static XFA), XFA rendering for SAP/AEM output (F-035) |
| pdftk fill_form, pdfcpu form, PyPDFForm, pdf-lib forms, fillpdf | filling | Phase 0 AE/AI, FDF/XFDF |
| Government form catalogues: cerfa (FR), IRS (US), HMRC (UK), ATO (AU), CRA (CA), Elster (DE) | real AcroForm/XFA | = pre-fill and JS-subset sandbox (F-035) |
2.14 Enterprise IT integration
| Tool | Strength | Take |
|---|---|---|
| ECM/DMS: SharePoint, Box, Alfresco, OpenText, Documentum, M-Files, Hyland, Laserfiche, iManage, NetDocuments, Nuxeo | content services | = connectors via apdf-server (F-051); Windows IFilter for search indexing, QuickLook/thumbnail handlers (03b §T) |
| RPA/ETL: UiPath, Automation Anywhere, Power Automate, Zapier | PDF activities | = CLI/REST parity so activities can call us |
| SAP (ArchiveLink, ADS/XFA), Salesforce, ServiceNow, Workday, Oracle | PDF generation/archiving | = JVM/.NET bindings + XFA rendering |
| Microsoft Purview/MIP, Google Workspace DLP, Symantec DLP | labelling, DLP | = MIP label read/write (§2.6) |
2.15 Fuzzing, robustness, corpora
| Resource | Take |
|---|---|
| SafeDocs CC-MAIN-2021-31-PDF-UNTRUNCATED (≈8 M PDFs, 8 TB, digitalcorpora.org), UNSAFE-DOCS (5 M incl. "Voice of the Offense") | = scale campaign (F-064) |
| GovDocs1, pdf-corpora index (PDF Association), Digital Corpora, OPF corpus, iText/Tika test resources | = internal corpora (never copied into the repo) |
| pdfium/pdf.js/mupdf/qpdf/PDFBox/pdfcpu suites | 🔬 mostly wired; iText and Tika to add |
| OSS-Fuzz, ClusterFuzz, AFL++, libFuzzer, honggfuzz | = continuous fuzzing (Phase 0 AH, F-065) |
2.16 Web and WASM
| Tool | Strength | Take |
|---|---|---|
| pdf.js, mupdf.js, PDFium.js, Apryse WebViewer, Nutrient Web SDK, Foxit WebPDF, embedpdf, ViewerJS | browser viewers | = apdf-wasm: render, text, forms, client-side signing (WebCrypto / CSC), HTTP range streaming of linearised files, Web Workers (F-012, F-050) |
| Gotenberg, Stirling-PDF, unoserver | servers | = apdf-server REST/Docker (F-051) |