Should I vibe code
View, annotate, convert, and organize PDFs across local devices
The file opens. The page count matches. The one form field that mattered is empty.
?
Their verdict, the Xodo Document Suite price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Xodo is not one product, it is a shelf of sixty discrete operations, and that shape is what fools people. Merge, split, rotate, compress, convert, OCR, flatten, annotate — each of those is a call into qpdf, pikepdf, Ghostscript or OCRmyPDF, and an agent will wire thirty of them together in an afternoon that feels like a triumph. The bill arrives at save time. A PDF is not a document, it is an object graph with cross-reference tables, and the naive way to write one back out is to rebuild it from whatever your library understood. Everything it did not understand leaves quietly: the values in the form you filled in last week, the signature that was valid until your byte offsets moved, the tagged structure a screen reader navigates by, embedded attachments, the annotations some other app made. The file opens. The page count matches. Nothing errors. Add the batch mode you will inevitably want, pointed at a directory, writing over its inputs, and the worst day is unrecoverable by design. Keep it local and keep it additive and this is a genuinely good weekend — a desktop tool has a real advantage over every web PDF service in that your contracts never leave the laptop. Just never put the only copy of anything through it, and leave signing to the products that keep an audit trail.
What actually breaks
not "if". the specific failures.
- Save, which in generated code almost always means regenerating the whole file from what the parser understood, and dropping whatever it did not
- Filled form values, which survive a merge in testing and vanish from the one page that had a checkbox on it
- Any existing digital signature, because it is a hash over byte ranges you have just moved — it now reads as invalid, which is worse than absent
- Tagged structure and reading order, invisible to every test you will write and the whole difference between an accessible document and a picture of one
- OCR, where the text layer lands a few points off the glyphs and search silently misses the page you needed
- Batch mode over a directory, where the bug and the only copy of the file occupy the same path
- "Remove password", which is one flag away from stripping the owner permissions off a document you were not meant to be able to edit
- The parser itself, since embedded JavaScript, XFA and malformed xref tables are a standard fuzzing target and your input is a file a stranger emailed you
- Compression, which quietly resamples the scan of the signed page down to the point where the amount is ambiguous
Is that you?
the verdict is a default, not a law
- It runs locally, on files you have a backup of
- Every operation writes a new file and never touches its input
- The output goes to you, not to a counterparty, a registry or a court
- You are replacing a web tool that uploads your contracts to a stranger's server, which is a real upgrade rather than a lateral move
- The output is a signed or filed document — that failure is about evidence, not PDFs, and dochub's entry covers it
- It processes a directory in place
- The inputs are forms other people filled in, because form data is the first casualty of a rewrite
- Accessibility matters, because tagged structure is silent until someone using a screen reader tells you it is gone
- You need the OCR to be trustworthy rather than present
If you build it anyway
the checklist, then the prompt that enforces it
- Never write to the input path. New file, new name, refuse to run if the destination exists. This single rule removes the only truly unrecoverable failure in the entry.
- Prefer content-preserving transforms and incremental updates over parse-and-regenerate. qpdf exists precisely because rebuilding a PDF from your own understanding of it is lossy.
- Write the no-op test first: read a file, write it unchanged, then diff object counts, form fields, annotations and signature dictionaries. If anything disappears on a no-op, every real operation loses it too.
- Assert on structure, not on "it opened". A test that counts pages passes happily on a document whose field values are gone.
- Treat a signed PDF as read-only. If the input has a signature dictionary, stop and say so rather than producing a file that reports as tampered.
- Parse hostile input in a sandbox: no network, no shell-outs with interpolated filenames, a memory ceiling, a timeout. Ghostscript CVEs are a genre.
- For OCR, keep the page image untouched and add the text layer beside it. Then verify by extracting the text and searching for a word you can see with your own eyes.
- Keep a manifest of input and output checksums for every run, so when something is wrong three weeks later you can prove which file you damaged and which you did not.
I am building a local PDF toolbox — merge, split, rotate, compress, convert, OCR,
annotate, fill. The failure I care about is a save that silently drops form values,
annotations or signature data and still produces a file that opens. Order the work
so that becomes impossible, and push back on shortcuts.
1. Nothing writes to its input. Every operation takes an input path and a distinct
output path, and refuses to overwrite an existing destination.
2. Before implementing any operation, write the identity test: read a PDF, write it
back unchanged, and assert equal page count, form field names and values,
annotation count and the presence of any signature dictionary. Use fixtures that
include an AcroForm, an annotated page, a tagged document and a scanned page.
3. Use qpdf/pikepdf-style content-preserving transforms. Do not construct a fresh
document and copy pages into it unless I explicitly ask, and if I do, say what it
will lose.
4. If an input carries a digital signature, stop. Report it and require an explicit
override, because re-saving invalidates it rather than removing it.
5. Parse untrusted files defensively: no network access, no shell command built by
string interpolation, a hard timeout and a memory cap per file.
6. Batch mode comes last, and only after a dry-run mode exists that prints every
planned write. When it does land, it writes into a separate output tree and logs
input and output SHA-256 for every file.
7. OCR adds a text layer beside the untouched page image. Include a verification
step that extracts the text and checks for words I supply.
8. Anything that removes encryption or permissions is behind an explicit flag and
logs what it stripped.
9. Deliberately out of scope: applying signatures, redaction, and reflowing body
text. Redaction is not a black rectangle and signing is an evidence problem, not
a PDF one — tell me to treat each as its own project.
10. Finish by reminding me that Stirling PDF already does most of this in the open,
and that Xodo's desktop licence is a one-off $240 if I only want it to work.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
The documents belong to somebody else, or the output is going somewhere that will reject it for a reason it will not explain — a registry, a court filing, a bank's upload form. $14.99 a month covers web, desktop and mobile, and the desktop app is $240 once and yours, which against a weekend of your time is not a close call. Pay especially for OCR you can trust and for redaction, because those are the two operations where being 95% right is the same as being wrong.
$14.99/mo is cheaper than your weekend.
This is one of the few entries with no exit problem, provided you keep it that way. Outputs are ordinary PDFs any tool can open, so nothing needs migrating the day you abandon the project. What matters is that the originals survive it: keep inputs immutable in their own tree, keep a checksum manifest of every run, and never let the tool be the only thing that knows what a file looked like before you touched it. If you do walk away, Stirling PDF self-hosted or Xodo's own free tier picks up the same work with no data to move.
Active open-source web application covering a broad set of PDF operations, and the closest thing to a self-hosted Xodo.
Content-preserving PDF transformer whose design goal is doing exactly what you asked and nothing else.
Adds a searchable text layer to scanned PDFs without disturbing the original page images.
Questions
Which half of this is actually worth building?
The additive half. Annotating, stamping, merging, splitting, rotating and converting are mature library calls, and running them on your own machine beats uploading a payslip to a web service. The half to leave alone is anything that rewrites the structure of a document you cannot recreate: filled forms, signed files, tagged documents, and batch jobs over folders you did not curate.
What is the one test that catches the worst bug?
Read a PDF and write it back with no changes, then assert that page count, form field values, annotation count and signature dictionary all survived. A no-op that loses data is a save routine that loses data on every operation, and it takes ten minutes to find out. Most homemade PDF tools have never had this test run against a file with an AcroForm in it.
Is a local PDF tool genuinely safer than an online one?
For confidentiality, yes, and it is the strongest argument for building this at all — the contract never leaves your disk. For integrity, no: the online services have run millions of documents through their pipeline and yours has run eleven. Treat the local build as a privacy win you pay for in fidelity, and keep backups accordingly.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
PDF is a format that hates you. Annotation is fine; editing is where it fights back.
The best reason to self-host PDF tools: your documents stop being uploaded to strangers.
Merge and compress are library calls. "Sign" is a legal instrument, and yours is a picture of a squiggle.
last reviewed 2026-08-05 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice