Urgent.News

What's breaking now, across thousands of outlets.

Tech

I Built a Full PDF Editor That Runs 100% in Your Browser — No Uploads, No Servers

Every PDF tool I tried had the same problem: upload your file to some server, wait, download it back — and hope the site deletes it. Contracts, ID cards, bank statements... people upload their most private documents to strangers' servers every day, just to merge two pages or add a signature. So when I built the PDF editor for Ali Tools (alitools.online), I set one hard rule: the file never leaves…

Every PDF tool the reporter tried followed the same problematic pattern: files were uploaded to third-party servers, processed, and then downloaded back. This exposed sensitive documents to unknown servers for merging, adding signatures, or other edits. Determined to avoid this, when building the PDF editor for Ali Tools, the reporter set a strict rule: the file never leaves the user's device. Rendering, editing, merging, splitting, and converting all happen locally in the browser.

The document is rendered page-by-page onto canvas elements directly from the file. A Web Worker handles the parsing so the user interface remains responsive, even when opening large files. Editing involves placing text, images, shapes, and signatures as absolute-positioned layers on top of the rendered page. Nothing is baked in until the user exports the edited document.

During export, a fresh PDF is assembled in memory from the original data and the user's edits, which is then downloaded by the browser. There's no upload step anywhere in the code path.

The site supports various conversions, like PDF to Word or images to PDF, all using the local-first pattern wherever possible. Why this local-first approach matters is clear: it prioritizes privacy by design, not just by promise. The reporter notes that files are automatically deleted after one hour, providing a guarantee that files are never stored longer than necessary.

Furthermore, the local-first approach significantly speeds up the experience. A 50 MB file opens instantly because it never has to travel across the network. Additionally, since hosting costs are minimal (static files plus the visitor's own CPU), the site can afford to keep every tool free with no accounts or limits.

The reporter faced a few challenges, however. Large PDFs on low-end phones can run into memory issues, requiring lazy page rendering strategies like rendering pages on scroll and releasing off-screen canvases. The editor's bundle is heavy, so it's code-split: the editor only downloads when it's actually opened, not on the initial landing page. This change improved mobile PageSpeed from the 50s to the 80s. Finally, different browser print pipelines require per-browser checks for the "Print to PDF" output.

The editor is freely usable without any sign-up required: https://alitools.online/pdf-editor/. The full toolbox, including image and video compressors, converters, calculators, generators, and more PDF tools, is available at https://alitools.online/. The reporter invites other web developers to consider adopting a local-first approach for their tools and asks for feedback on any barriers they might face.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

PHP Ships Fixes for Two Critical Unauthenticated-RCE Flaws

The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21 to address CVE-2026-109618 and CVE-2026-109619.

  • PHP releases patches for two critical unauthenticated RCE flaws
  • CVE-2026-109618 and CVE-2026-109619 vulnerabilities rated 9.2
  • Public-facing services in Netherlands, Finland, Denmark, France affected

More from Friday 23 October →