mrkeyoor.com_
Tue 01 Sept 17:44 UTC
Self-Hostedevaluationupdated 26 Aug 2026

Stirling-PDF review

Stirling PDF is a self-hosted PDF workbench for editing, merging, splitting, signing, redacting, converting, OCR, compression, and repeatable document workflows. It gives people a browser interface, a desktop client, and an API so sensitive files can stay on equipment they control.

+636stars / 7d
Verdict

Our 23-second install covered only Stirling PDF's 122-package developer-tool folder, so it proves the repo tooling is tidy but says nothing about server readiness. Use Stirling PDF when several people need a private browser toolbox and someone can own the container, storage, updates, and exposure of document-processing endpoints. Choose a smaller desktop or command-line tool when the job is only page rearrangement or scripted transforms.

We ran it

Lab card: what happened when we ran Stirling-PDFScreenshot of Stirling-PDF (stirling.com)
Install✓ · 23s122 packages · 19 MB
Buildn/ano build script
Testsn/ano test script
Known vulns00 critical · 0 high · 0 moderate · 0 low (npm audit)
Repo6860 files~913,852 lines of source · 202.1 MB · 41 CI workflows

Answers from our run

Does Stirling-PDF build from source?

Dependencies installed in 23 seconds (122 packages), and the project has no separate build step. We cloned commit 353df7a into a clean Debian container with 3 CPUs and no project-specific setup.

Does Stirling-PDF have tests you can run?

Not through a standard command: the project exposes no test script or target that our harness could run.

Does Stirling-PDF have known vulnerabilities in its dependencies?

npm audit found none in the dependency tree at the time of our run.

Who should not use Stirling-PDF?

Buyers who require every useful administration feature under a conventional open-source license: the README calls the product open-core and links SSO and auditing to paid offerings.

What are the alternatives to Stirling-PDF?

PDFcpu, PDF Arranger, Paperless-ngx. Our 23-second install covered only Stirling PDF's 122-package developer-tool folder, so it proves the repo tooling is tidy but says nothing about server readiness.

Setup4/5One container command, with production access controls left to you
Docs4/5Clear quick start and separate guides for server and developer work
Community5/5Pushed on August 26 with busy issue and pull-request activity
Maturity4/5Broad product surface, tempered by current desktop and conversion bugs

Discussed on

  1. hnStirling PDF: Self-hosted, web-based PDF manipulation tool366 points
  2. hnStirling PDF 2.05 points
  3. hnStirling PDF v2.0 Released4 points

Who it’s for

Small teams that regularly alter PDFs and want the files kept on their own server.
Administrators replacing a collection of single-purpose PDF websites with one browser tool.
Developers who need PDF operations behind a REST API or repeatable visual workflow.
Households and offices comfortable running a container and maintaining its storage and access controls.

Who it’s NOT for

Buyers who require every useful administration feature under a conventional open-source license: the README calls the product open-core and links SSO and auditing to paid offerings.
Developers judging the application through a normal npm project: the npm target our lab found lives under devTools/ and has no build or test target for the PDF server.
Mac users who need an uneventful desktop rollout today: current reports include a blank window on macOS 12.7.6 and saved PDFs hanging at Loading tool... after reopening.
Teams that cannot review network-facing document converters carefully: an open security report concerns external-reference handling in flat OpenDocument to PDF conversion.
Operators wanting a small codebase to understand quickly: our checkout contained 6,860 files and about 913,852 source lines.

Setup reality

Our sandbox installed the npm tooling under ./devTools/ in 23 seconds: 122 packages and 19 MB on disk. That target had no build or test script, so both steps were skipped. Its npm audit found 0 known vulnerabilities. This verifies the developer-tool package, not a working Stirling PDF server.

The user-facing README takes a different route: run the published container on port 8080, use a desktop build, or follow the separate Kubernetes documentation. A private deployment still needs persistent storage, an access policy, and any authentication, SSO, API, or workflow settings your office requires.

The checkout was 202.1 MB with 6,860 files and roughly 913,852 source lines. Our measured target reported 41 CI workflow files, no Dockerfile, and no tests directory, while the README directs ordinary users to a published container image and contributors to Task plus the developer guide. Those are separate setup paths, and the 23-second npm result should not be read as server setup time.

It replaces a drawer of one-job PDF websites

Stirling PDF puts more than 50 PDF operations behind one interface. The README names editing, merging, splitting, signing, redaction, conversion, OCR, compression, and automation. You can use a desktop client, open the browser UI against your own server, or call private APIs for nearly all tools. A team can stop uploading contracts to unrelated web converters and give staff one known place to work.

Its visual pipelines can string operations together, while the API lets an internal application submit the same jobs. That suits recurring work such as splitting intake packets, applying OCR, or converting office files before archival. The README claims workflows can process millions of PDFs, but our lab did not benchmark throughput, document fidelity, or concurrency. Test capacity against your files and hardware.

The published container is the shortest user path

The README's quick start is a single container command that maps port 8080. Desktop and Kubernetes installations have separate documentation, and contributors are pointed to Task, task dev, and a developer guide. Our checkout at commit 353df7a occupied 202.1 MB and contained about 913,852 source lines across 6,860 files.

A production service still needs decisions the quick start cannot make for you. PDFs may contain contracts, financial records, identity documents, or medical information. Decide where files persist, who can reach port 8080, how authentication works, which API routes are exposed, and how backups are handled. The README links paid server options for SSO and auditing. It also calls the licensing model open-core, which matters if procurement assumes every administration feature is community licensed.

What happened when we ran it

Our sandbox found the npm project under ./devTools/ and installed its 122 packages in 23 seconds. The install used 19 MB on disk, and npm audit returned 0 known vulnerabilities across all four severity levels. That is clean for the measured dependency set. It does not show that the Java application, desktop client, OCR stack, or published container started successfully.

There was no build script or target in that npm project, so our build stage was skipped. Tests were also skipped because no test script or target was available; the harness recorded no tests directory. The checkout exposed 41 CI workflow files but no Dockerfile to the measured target. Our run assessed the repo's developer tooling path, while the README's normal user path pulls a prebuilt Stirling PDF image.

A developer who enters devTools/ gets a quick, small npm install but no command that produces or verifies the PDF service. Application work follows the Task-based contributor route. Product evaluation should start with the published container or desktop package and representative documents. The 23-second install is not Stirling PDF deployment time.

Open-core administration changes the buying decision

The core attraction is local document handling. Files do not have to go to an external conversion site, and a server gives colleagues a browser UI. The API and workflow layer cover jobs that a desktop-only editor cannot share. Support for more than 40 interface languages also helps offices where the people processing documents do not all use English.

Local hosting transfers responsibility. An open report filed on August 22 concerns flat OpenDocument files bypassing external-reference sanitization during Office-to-PDF conversion, with possible server-side requests and local-file readback. We are not treating an open report as a confirmed advisory, but anyone accepting untrusted conversions should examine that issue and the maintainer response before deployment. Network isolation and restricted file permissions belong in the review.

The latest release, v2.14.3 from August 6, was a bug-fix release. Its notes mention repairs for Debian 12 and Fedora 44 operations, concurrent use of tools such as merge, automated image removal, large 2 GB files in some scenarios, and desktop startup. That shows how many operating-system, file-size, and concurrency edges a broad PDF suite must cover.

Desktop users should test their exact operating system

Current issue activity gives Mac users reasons to trial the desktop app. One report describes no visible window on an Intel MacBook Pro running macOS 12.7.6. Another says previously added PDFs remain at Loading tool... after reopening. A separate report describes a hang when quitting through Command-Q. These are specific reports, not proof that every Mac installation fails.

Browser use has rough spots too. Recent reports cover text selection, metadata dates that do not apply, and a Kubernetes deployment failure around a temporary-file shutdown hook. The repository was pushed on August 26, 2026, and current activity includes fixes and feature work. GitHub lists 577 open issues and pull requests combined; a search excluding pull requests returned 369 open issues. The queue is large, but it is moving.

Pick it for shared breadth, not one narrow PDF job

Stirling PDF fits an office that needs many document operations in one private service. A person who only rearranges pages has less to maintain with PDF Arranger. A backend job that stamps, validates, or transforms PDFs may be easier to audit around PDFcpu. Paperless-ngx is the better comparison when the desired outcome is an indexed archive rather than edited files.

Our npm run was clean and small, but it never built or tested the product server. The README offers a short container start, while deployment includes storage, access control, updates, and scrutiny of converters that accept untrusted documents. Stirling PDF earns its operational cost when the shared UI, 50-plus tools, workflows, and API all get used. If only one feature matters, install less software.

Alternatives

ProjectWhat it isPick it when
PDFcpuA Go command-line tool and library for scripted PDF processing.pick this instead when shell automation and a small deployable binary matter more than a shared browser interface.
PDF ArrangerA desktop application for visually rearranging, merging, splitting, and cropping PDF pages.pick this instead when one desktop user mainly needs page organization and does not want to operate a server.
Paperless-ngx gh↗A self-hosted archive that ingests, OCRs, tags, and searches household or office documents.pick this instead when filing and retrieving documents is the job, rather than editing and transforming PDFs.

What people are saying

  1. [velocity-scout] Stirling-Tools/Stirling-PDF

Sources

  1. Stirling PDF README
  2. Stirling PDF v2.14.3 release
  3. Stirling PDF documentation
  4. Stirling PDF open issues
  5. Flat OpenDocument conversion security report

More self-hosted reviews

v2 · OpenShell · wigolo · Mindwtr · club-3090 · reclip · the whole board →