Local-first · Free & open source

Every PDF tool you need, on your own machine.

Fill, OCR, redact, compare, reflow, tag for accessibility, sign, convert, and reshape PDFs — without a subscription, an account, or the cloud.

Nib opens like a desktop app but runs as a tiny local server in your browser. One self-contained binary. Every edit happens on your machine, and the only documents that ever go anywhere are the ones you deliberately send to someone you're signing with.

Download Sign with several people

Offline by default · AGPLv3 · Linux, macOS & Windows · no account, ever

One tool for everything you do to a PDF

From a quick form fill to a cryptographic signature — the whole workflow, in one place, on your machine.

Fill any form — even flat scans

Type into real AcroForm fields, or onto a flat or scanned page. Detect finds the blanks — lines, boxes, table cells, checkboxes, circle-one choices — and Save as fillable form turns a scan into a real fillable PDF, dropdowns and radio groups included.

Form data in and out

Mail-merge a form from a spreadsheet — one filled PDF per CSV row, zipped. Trade data with Acrobat and Foxit as XFDF, or export fills to JSON and CSV. All of it on your machine.

On-device OCR, 41 languages

Make scans searchable with an invisible text layer — Latin, Cyrillic, Greek, Arabic & Hebrew (RTL), Thai, the Indic scripts, and Chinese, Japanese & Korean. The engine is built into the binary: no install, no upload.

Real redaction

Black boxes that actually remove what's underneath — not a rectangle over live text. Search-and-redact every SSN, email, phone, or card number in one pass.

Visual & text compare

See what changed between two versions: a word-level text diff, a side-by-side view, and a per-pixel difference map that works on scans. Pages auto-align, so an inserted page doesn't make every later page read as changed — and a page that simply moved is reported as a move.

Edit text & annotate

Drag a box over baked-in text and retype it in the original's size, colour and closest font. Highlight, draw freehand, add shapes and borders in any colour, and drop sticky notes any PDF viewer can read.

Reflow a paragraph

Change a paragraph's words and Nib re-sets it in the document's own font, spacing and justification — the rest re-wraps, the text below moves down and onto the next page, and the notes, links and form fields beside it go too. The old words are removed, not covered. What it can't set exactly, it refuses and says why.

Tag it for screen readers

Tag structure proposes an untagged document's headings, paragraphs and lists for you to review before anything is written. Review Structure Tree corrects any document's tags — type, alt text, header scope, reading order — entirely from the keyboard.

Check accessibility (PDF/UA)

A report against 105 of the 106 PDF/UA-1 rules the reference validator veraPDF evaluates, each clause marked passes, fails, does not apply, or could not check — never a pass it didn't earn. A checker, not a certificate; nib ua does the same from a script.

Sign & timestamp

Certify with Nib's identity or your own CA-issued .p12 certificate, fix the time with an RFC-3161 timestamp, or anchor proof-of-when to the Bitcoin blockchain with OpenTimestamps.

Send it out to be signed

Place sign, date, initial, name, title and company flags, lock the layout, and save a file that opens in signing mode for whoever receives it — guided flag to flag, ending in their own certified signature. Like DocuSign, with no cloud and no sidecar to lose.

Co-sign with one peer

Two people sign the same document, each attesting to the other's pinned identity — pass the file however you like, or run it live over a mutually-authenticated channel with no server in the middle.

Ceremonies for three or more

A lease with a guarantor, a deed with witnesses, a board resolution: one proceeding, one roster of up to 32 parties, one document passed in order until everyone has signed — then a delivery round that tells you exactly who has their copy. How a ceremony runs →

Verify what you're handed

Every PDF opens with a badge — untampered, modified, or unsigned — and details for every signer, including whether each signing time is backed by an independent authority or merely claimed. nib verify prints the whole roster and exits non-zero when an obliged party hasn't signed.

Convert Office, Markdown & PDF/A

Markdown converts natively, in pure Go, with non-Latin scripts embedded as needed. Word, Excel, PowerPoint and OpenDocument go through LibreOffice if you have it — optional, detected at runtime, never bundled. Export archival PDF/A-2b for documents that must outlive their apps.

Tables → spreadsheets

Pull a page's table straight out to XLSX, ODS, or CSV — the spreadsheet is built on your machine, no office suite required. Text and embedded images export too.

Reshape pages

Merge, rotate, crop, N-up, normalize mixed sizes, stamp Bates numbers, set logical page labels, insert or duplicate pages, and author the bookmark outline — one undo history walks back all of it.

Split it up, or shrink it down

Burst a PDF into files by bookmark, by page range, or every N pages; cut a scanned 2-up sheet into a grid, or by boxes you draw. Reduce file size losslessly, or re-render to images when a scan needs to get small.

Several documents at once

Opening a document adds it rather than replacing it — a tab strip, each with its own scroll, zoom and unsaved fills. Up to eight documents or 512 MB, refused plainly rather than degrading, and a browser reload brings them all back.

Encrypt, unlock & sanitize

AES-256 password protection, and the way back out for a file you're authorized to edit. Scan for hidden content — JavaScript, auto-run actions, embedded files, metadata — and strip it four ways, gentlest first. Attach files, or extract the ones already inside.

Scriptable command line

Twenty-seven headless nib commands — sign, verify, tag, check accessibility, split, fill, convert, timestamp — batch a whole folder in place, or pipe PDFs through stdin and stdout. A signed PDF is refused in place rather than silently invalidated.

See it in action

A real desktop-style window, running in your browser. Six jobs, each caught part-way through — a form being filled, a scan being read, identifiers marked but not yet burned in, a proceeding waiting on its first signature. Click any shot to enlarge.

Nib filling a flat membership application: Detect has dropped fillable boxes on every blank, five are filled in, the cursor sits in the next one, and a subscription option has been circled. — A flat form, detected and half-filled

Nib's difference map over two scanned drafts of a lease: pages aligned, 46,585 pixels changed (2.4%), the reworded repairs clause picked out in red. — Two scanned drafts, aligned and diffed

Nib part-way through OCR on a three-page scan — the sidebar reads OCR 1 of 3, with the language and the Best 300-DPI quality setting beside it. — OCR, one page into three

A claim file with every social security number, phone number, email address and card number marked as a redaction box — Apply redactions still waiting in the sidebar. — Every identifier marked, none burned in yet

Signing flags planted on a form's Signed and Date lines, with Signing marks completed and Save for signing waiting in the sidebar. — Flagged, ready to send out for signature

A live signing ceremony in Nib's panel: the recital, the deadline, a five-party roster with one signing as Director, and the line 'It is your turn to sign (1 of 5 signing)'. — A five-party ceremony, waiting on signature one

Signing, from one name to thirty-two

Most PDF tools stop at "apply a signature". Nib carries the whole proceeding — placing the blanks, getting the file to the people who must fill them, and proving afterwards who signed what — with no account and no server holding the document in between.

1 · Sign it yourself

Finalize & sign seals the document with a certification signature and a visible watermark — Nib's own identity, or your CA-issued certificate so a verifier who trusts the issuer sees a trusted signature. Add an RFC-3161 timestamp to fix the time. Any later edit breaks the signature; that's the point.

2 · Send it out to be signed

Plant the sign / date / initial / name / title / company flags, then lock the layout so it can't drift before it goes out. The flags travel inside the PDF — no sidecar — so it opens in signing mode for the recipient, walks them field to field, and ends in their own tamper-evident signature.

3 · Two people, co-signed

Both parties sign the same document, each attesting in a cryptographically-signed reason that they accept the other's identity — pinned by a fingerprint you compare once, out loud. Pass the file by email or USB, or run it live over a mutually-authenticated encrypted channel that tears down after one exchange.

4 · Three or more: convene a ceremony

Pick the document, write a short recital of what is being agreed, tick the parties out of the people you've already paired with, and set a deadline. Nib issues one invitation per party, each carrying only that party's own secret. No fingerprint is typed, and none is shown — a person is a name and, where it matters, a capacity like as Director.

5 · One instrument, in sequence

The document goes to the first signing party, comes back, goes to the second, and so on. Every hop is an encrypted connection to a party whose key the invitation named, and every signature is checked against the ceremony's record — including the document's own bytes — before the next hop starts. While it's travelling, editing or saving over it is refused, and says which proceeding is holding it.

6 · Everyone gets their copy

At the end the convener runs a delivery round, and Nib reports each party separately: who has their copy, who already had it, and who couldn't be reached and why. Pressing it again retries only the ones still missing. Nothing retries behind your back, and nothing is stored on a server in between.

Nib's convene sheet: a recital of what is being agreed, a deadline, and four already-paired people ticked as parties — one of them signing as Director. No fingerprint appears anywhere on the form. — Convening: a recital, a deadline, and people you have already paired with — no fingerprint is typed, and none is shown.

A ceremony can end four ways and Nib tells them apart, because they call for different actions: completed, declined (the convener attests to the refusal and delivers that attestation — signatures already given still stand), expired (the deadline is inside what everyone signed, so any party's own Nib refuses a late contribution), and abandoned (nothing was ever heard — a conclusion your machine draws, since the party who would attest is the one that stopped answering).

And the limits are stated rather than hidden. The deadline can't be extended and a party can't be swapped — both are inside what everyone signed, so changing either means convening again. Nib executes one instrument in sequence, not in counterparts. Two people on the same network find each other with no internet at all; reaching someone further away means an address you exchange yourselves, a VPN you both trust, or an invitation — which uses the public BitTorrent DHT as a meeting point, and the project documents exactly what that reveals rather than glossing it.

Why Nib

🔒

Local by default

Editing, OCR, redaction, signing and export all happen on your machine, over 127.0.0.1. No account, no telemetry, no analytics, no crash reports — ever. The handful of things that do use the network are listed below, and every one of them is started by you.

🆓

Free & open

AGPLv3, top to bottom. Read it, rebuild it, trust it. No subscription, no per-seat license, no upsell — the whole tool, for everyone, for free.

📦

One binary

A single self-contained download — the UI, the PDF engine, and the OCR are all embedded. No installer, no runtime, no dependencies to chase.

⌨️

App or CLI

Click through a desktop-style window, or script every operation from the command line and batch an entire folder. Same engine, your choice.

🔑

Sealed to your SSH key

Your signing identity, image library, autofill profile and recent files live in one AES-256-GCM vault that unlocks with no password — it's sealed to a key you already have. Authorize several keys to work across machines, and back the whole thing up encrypted.

🤝

No server in the middle

Nib operates no relay, no rendezvous service, no signing back end — because it has no back end at all. Signing with other people goes peer to peer, pinned to keys you compared yourselves.

What actually uses the network, and nothing else does: an optional update check against GitHub at startup (switch it off in Settings); the SHA-256 hash — never the document — sent to public OpenTimestamps calendars when you timestamp; a block lookup when you verify one; a digest sent to the timestamp authority you named; opening a document by URL; finding a peer when you arm a ceremony from an invitation, which asks the public BitTorrent DHT only after the local network hasn't answered; and sending a document to the person you're signing with. That last one is the feature, not a leak — the pin means only they can receive it — and the project's README lists every one of these in a table rather than claiming the tool never touches the wire.

How Nib compares

Against the three best-known commercial PDF editors and two popular free ones. Legend: ✅ built in · 🟡 partial or limited · ❌ not available.

Capability	Nib	Adobe Acrobat Pro	Foxit PDF Editor	PDF-XChange Editor	PDF24 Creator	PDFgear
Fill forms — including flat & scanned	✅	✅	✅	✅	🟡	✅
Turn a scan into a fillable form	✅	✅	✅	✅	❌	🟡
On-device OCR (41 languages)	✅	✅	✅	✅	✅	✅
True redaction + PII search-and-redact	✅	✅	✅	✅	🟡	🟡
Visual and text document compare	✅	✅	✅	🟡	🟡	❌
Edit existing text with paragraph reflow †	✅	✅	✅	✅	❌	🟡
Accessibility check against PDF/UA ‡	✅	✅	✅	✅	❌	❌
Tag an untagged document automatically ‡	🟡 headings, paragraphs, lists	✅	✅	❌	❌	❌
Correct the tag tree and reading order ‡	🟡 no new or deleted tags	✅	✅	✅	❌	❌
Digital signature with your own certificate	✅	✅	✅	✅	✅	✅
RFC-3161 trusted timestamp	✅	✅	✅	✅	❌	❌
OpenTimestamps (Bitcoin) proof of when	✅	❌	❌	❌	❌	❌
Peer-to-peer co-signing, no server *	✅	❌	❌	❌	❌	❌
Multi-party signing ceremony (3–32), no server or account *	✅	❌	❌	❌	❌	❌
Send a document out to be signed, no cloud *	✅	❌	❌	❌	❌	❌
PDF/A archival export	✅	✅	✅	✅	✅	✅
Office ↔ PDF conversion	✅	✅	✅	🟡	🟡	✅
Table → spreadsheet (XLSX / ODS / CSV)	✅	✅	✅	🟡	❌	🟡
Merge, split, rotate, crop, N-up, Bates, labels	✅	✅	✅	✅	🟡	🟡
AES-256 encryption	✅	✅	✅	✅	✅	🟡
Scriptable command line / batch a folder	✅	❌	❌	🟡	🟡	🟡
Runs offline, no account, no telemetry	✅	❌	🟡	✅	✅	🟡
Free & open source (AGPLv3)	✅	❌	❌	❌	❌	❌
Single self-contained binary, cross-platform	✅	❌	❌	❌	❌	❌
Price	🟢 Free	🔴 Subscription	🔴 Paid	🟡 Free tier	🟢 Free	🟢 Free

* The three signing rows are about doing it without a service. Acrobat and Foxit both offer send-to-sign and multi-party workflows — through Acrobat Sign and Foxit eSign, which means their servers, their accounts, and your document on someone else's machine. Nib's equivalents run between the signers' own copies of Nib, pinned to keys the signers compared themselves.

† Nib re-sets changed words in the document's own font, size, spacing and justification, removes the old words rather than covering them, and carries the text below down the page and onto the next. It changes only what it can set exactly: a paragraph it cannot rewrite faithfully is refused with the reason, and cover-and-replace Edit text is there for those.

‡ Nib's checker covers 105 of the 106 PDF/UA-1 rules the reference validator veraPDF evaluates and never shows a clause it could not check as a pass; it has no WCAG check and offers no automatic fix. Against Acrobat Pro, every accessibility feature is laid out one by one — each Adobe claim quoted, each Nib claim naming its test, every gap listed — in the project's accessibility parity ledger.

The Foxit, PDF-XChange, PDF24 Creator and PDFgear accessibility cells, and the whole of the PDF24 Creator and PDFgear columns, are read from those vendors' own feature pages, help forums and changelogs, not measured — ❌ there means not listed. PDF24 Creator and PDF-XChange Editor are Windows-only; PDFgear has no Linux build and its AI assistant uses the cloud.

Acrobat, Foxit and PDF-XChange are mature commercial editors that do plenty Nib doesn't aim to — full WYSIWYG layout editing, prepress, cloud collaboration. PDF24 Creator and PDFgear are free, capable everyday tools, though neither is open source. This is about the jobs Nib does cover, and where it works differently. Reach for a commercial editor when you need full content editing; reach for Nib when you want to own your tools.

How it works

Nib is one small Go program — pure Go, no cgo. It serves its whole interface, a PDF engine and the OCR to your browser over 127.0.0.1, guarded by a per-process CSRF token and a loopback-origin check. Your signing identity, image library and profile live in an AES-256-GCM vault sealed to your SSH key, so it unlocks at startup with no password. The only listener that ever faces the network is one you arm yourself for a signing session, pinned to a single peer's key, and it's torn down when the exchange is done. Build it and run it:

# build the single binary
go build -o nib ./cmd/nib

# open a document in the desktop-style app
./nib invoice.pdf

Or skip the window and script it — twenty-seven headless commands, composable through stdin and stdout:

# certify a contract with your own certificate
nib sign contract.pdf -o signed.pdf --cert me.p12

# anchor proof-of-when to the Bitcoin blockchain
nib timestamp report.pdf

# check a signature — exit 2 if it is unsigned, modified,
# signed over only part of the file, or missing a party
nib verify lease.pdf

# fill one form per row of a spreadsheet
nib fill form.pdf --data rows.csv --out-dir merged/

# scrub a whole folder of hidden content, in place
nib sanitize -w *.pdf

# shrink then scrub — composed in one pipeline, no temp file
nib optimize in.pdf -o - | nib sanitize - -o clean.pdf

Handed a signed multi-party document, nib verify reads out the whole proceeding — the recital, who was obliged to sign, and who actually has — so a stranger can check a nine-party deed in one command:

$ nib verify lease.pdf
lease.pdf: valid (5 signer(s))
  ceremony 19db9b44b8d3…: 5 of 9 obliged signer(s) have signed
  recital: "We agree to be bound by the lease of 14 Elm Row"
  INCOMPLETE — 4 obliged party(ies) have not signed
  every signature commits to this document's ceremony
  ✓ Alice Tenant                 signed
  ✗ Frank Director               HAS NOT SIGNED

Add --json and the same facts come out as fields, so a build step or a filing system can gate on them. A document that belongs to no proceeding gets no ceremony section at all — describing it as a ceremony of nobody would be a verdict on something that doesn't exist.

Download

One self-contained binary — fully offline, with no runtime dependencies. Grab the build for your system, or find every platform, architecture, and past version on GitHub.

Linux

Debian & Ubuntu get a .deb that adds Nib to your Office menu. Any other distro: the static nib-…-linux-<arch> binary runs anywhere.

Download .deb (Debian / Ubuntu)

Static binary (any distro)

macOS

One self-contained binary for Intel (amd64) and Apple Silicon (arm64). No installer — download nib-…-darwin-<arch> and run it directly.

Download for macOS

Windows

A standalone nib-…-windows-<arch>.exe for amd64 and arm64. Nothing to install — run the executable and Nib opens in your browser.

Download for Windows

All platforms

On a different system, or want a specific architecture, checksum, or past version? Every build and the full source live on the project's GitHub page.

View on GitHub

On Debian or Ubuntu, install the downloaded package so Nib appears under your Office menu:

sudo dpkg -i nib_*.deb

Prefer to build from source? It's one Go command — Linux, macOS, or Windows. The -ldflags is what stamps the build with its version, so the in-app version pill reports a release rather than dev:

git clone https://github.com/daniel-alexander4/nib && cd nib
go build -ldflags "-X main.version=$(cat VERSION)" -o nib ./cmd/nib
./nib

The first run explains what the SSH key protects, then either uses a key you already have or creates one for you, and opens Nib in your browser. No account to create and nothing to configure. On Windows, nib register puts Nib in Explorer's Open with menu for PDFs — per-user, no administrator rights. Opening several PDFs through Nib gives you one Nib holding them all, a tab each: a second launch hands its document to the one already running rather than starting a rival copy.

Own your PDF workflow.

Free, open, and entirely yours — on your machine, for as long as you keep it.

Download See the features