I got tired of PDF tools that upload your files to servers you know nothing about. So I built FoldPDF.
The idea was simple — most PDF operations don't need a server at all. Merging, splitting, rotating, adding watermarks, signing, protecting — all of this can happen directly in the browser using JavaScript libraries. Your file never has to leave your device.
The tech stack
Frontend: Next.js hosted on Vercel. Most tools use pdf-lib and pdf.js running client-side in the browser.
Backend: Python Flask hosted on Render. Only four tools actually hit the server — Compress PDF, PDF to Word, PDF to PowerPoint, and PowerPoint to PDF. These need server processing to deliver quality results that client-side libraries can't match.
For compression I use Ghostscript with three presets — screen, ebook, and printer — which map to ultra, smart, and quality compression levels in the UI.
For PDF to Word and PDF to PowerPoint I use Adobe PDF Services API. I tried pdf2docx and LibreOffice first but the output quality wasn't good enough. Adobe's API preserves fonts, spacing, and document structure properly.
For PowerPoint to PDF I use LibreOffice on the server. It works well but takes 30-60 seconds on the free Render tier — something I'm actively working on improving.
The privacy approach
Files sent to the server are deleted immediately after download. Nothing is stored, nothing is logged. For the four server-side tools I added a clear notice on each tool page so users know exactly what's happening to their file.
Everything else — merge, split, rotate, watermark, sign, protect, unlock, repair, OCR, image conversions — runs entirely in the browser.
What I learned
Client-side PDF processing is genuinely powerful but has real limits. pdf-lib is excellent for manipulation but struggles with complex documents. For anything involving document structure preservation, a proper server-side tool wins every time.
Free hosting tiers are tricky for CPU-heavy tasks. LibreOffice cold starts on Render's free tier are slow. UptimeRobot keeps the server alive but doesn't pre-warm LibreOffice itself.
Reddit and Hacker News block new accounts from posting — learned that the hard way today.
Try it
foldpdf.online — 30+ tools, no account needed, completely free.
Would genuinely love feedback from this community — what's broken, what's missing, what could be better.
Intelligence View
⚡ tsecurity.de Intelligence
How I built a privacy-first PDF toolkit with Next.js and Flask
I got tired of PDF tools that upload your files to servers you know nothing about. So I built FoldPDF. The idea was simple — most PDF operations don't need a server at all. Merging, splitting, rotating, adding watermarks, signing, p…
Reagiere als Erste:r — dein Feedback zählt!
IR-PLAYBOOK-RCEHIGH
Schritte anzeigen
SOC Incident Playbook: Remote Code Execution (RCE) Defense
1-Click Detection Engineering: Sigma & YARA RulesSOC Ready
Regeln anzeigen
title: Detect Exploitation - How I built a privacy-first PDF toolkit with Next.js and Flask
id: 433a4bb7-8b9f-4138-a187-78a7bb4f58e8
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
- https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
category: network_connection
product: any
detection:
selection:
CommandLine|contains:
- 'exploit'
condition: selection
falsepositives:
- Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
- attack.initial_accessrule CTI_Threat_Indicator {
meta:
author = "iShareStuff CTI Automated Detection Engine"
date = "2026-09-24"
description = "YARA Signature for "
strings:
$str = "How I built a privacy-first PD" ascii wide
condition:
any of them
}tsecurity.de Cognitive Threat RAG
Fokus-Vektor:
Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich How I built a privacy-first PDF toolkit .... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.
🛡️ Angriffsfläche & Exposure
Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.
⚡ Empfohlene Sofortmaßnahmen
- 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
- 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
- 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days
MariaDB 11.7 VEC
Synthetische RAG-Antwort
SOCIAL SHARE CARD GENERATOR