PdfDing

Self-hosted PDF management, honestly reviewed. No marketing fluff, just what you get when you run it on your own server.

TL;DR

• What it is: A self-hosted, browser-based PDF manager, viewer, and editor. Think: a private Dropbox-style library for PDFs, with reading-position memory, annotations, highlights, and tags — all running on your own hardware [README].
• Who it’s for: Founders, researchers, and small teams who accumulate PDFs and want to organize, annotate, and share them without feeding documents to a cloud service [1][README].
• Cost savings: Adobe Acrobat Pro runs ~$19.99/month. PdfDing is free software (AGPL-3.0) that runs on a $5–10/month VPS with no per-user, per-document, or per-feature fees [README][3].
• Key strength: Opinionated, minimal scope — it does PDF management, reading, and light editing without bloat. The reading-position memory across devices is the kind of small detail that makes it actually useful [README].
• Key weakness: It’s a PDF library tool first, not a PDF processing powerhouse. If you need OCR, batch format conversion, or deep document manipulation, this isn’t that tool [1]. Also: a high-severity authorization vulnerability (CVE-2026-34376) was patched in v1.7.0 — if you’re running anything older, update immediately [2].

---

What is PdfDing

PdfDing is a browser-based PDF manager you host yourself. The pitch is in the README: “minimal, fast, and easy to set up using Docker.” The name is literal — PDF + ding, the German word for “thing.” It’s a thing for your PDFs [README].

The project was initially inspired by linkding, the self-hosted bookmark manager, which explains its philosophy: bring the same focused, fast, bookmark-manager experience to PDFs rather than trying to be an all-in-one document suite [README]. Originally hosted on Codeberg, it migrated to GitHub in late 2024 [4], and as of this writing sits at 1,657 stars, 96 forks, and 42 releases [README].

It’s funded in part through the NGI0 Commons Fund established by NLnet, with backing from the European Commission’s Next Generation Internet programme — a small but meaningful signal that someone other than the developer is invested in it surviving [README].

What it actually does: you upload PDFs, organize them into workspaces and collections with multi-level tags, read them in the browser (with your position saved so you can pick up across devices), add annotations, highlights, and text edits, write markdown notes against each document, and optionally share them via link or QR code. That’s the whole product. It doesn’t try to be more than that [README].

---

Why people choose it

The third-party coverage on PdfDing is thinner than for something like Activepieces or n8n — it’s a newer project with a narrower scope. But the available context is consistent.

Versus cloud PDF tools. The privacy argument is the primary driver. If you’re working with legal, financial, or client documents, uploading them to Smallpdf, Adobe Document Cloud, or similar services means trusting those companies with the content. Make Tech Easier [1] frames it directly: self-hosted open-source tools “give you full control over your documents, keep your data private, and often rival (or even beat) the functionality of commercial tools.” PdfDing sits squarely in that frame — it’s not a better PDF editor than Adobe Acrobat, but it’s one that doesn’t require sending your files to a third party.

Versus Stirling-PDF. This is the most useful comparison in the self-hosted space. Make Tech Easier [1] covers both tools and draws the line cleanly: Stirling-PDF is the “Swiss Army knife” — merge, split, OCR, compress, convert, watermark, rotate, compare. PdfDing is the reading and annotation layer: “less about complex document processing… more about direct content editing such as changing text, moving images, and adding annotations.” They’re solving different problems and are arguably complementary rather than competing. If you need batch operations and format conversions, use Stirling-PDF. If you need a searchable, tagable PDF library you can read and annotate across devices, use PdfDing [1].

The reading-position memory. This is the detail that makes PdfDing different from just throwing PDFs into Nextcloud. The reader tracks your position per document, which matters if you’re actually reading long-form PDFs rather than just managing files. Technical manuals, research papers, financial reports — if you stop halfway and come back on a different device, you continue where you left off [README]. No cloud PDF manager you pay for defaults to this behavior.

Self-h.st newsletter coverage. The project has appeared multiple times in the self-hosted community newsletter, which tracks releases across the ecosystem. The v0.5.0 mention in November 2024 covered the GitHub migration, inverted color reading mode, and bulk uploads [4]. The v0.10.0 mention in January 2025 highlighted Markdown notes and improved shared PDF prompts [5]. The cadence of meaningful releases in the news suggests the project is actively maintained, not stagnant.

---

Features

Based on the README and third-party descriptions:

Reading and organization:

• Browser-based PDF viewer across devices — no app installs required [README]
• Reading position memory — continue where you left off, on any device [README]
• Workspaces, collections, multi-level tags, starring, and archiving [README]
• Progress bars showing reading completion per document at a glance [README]
• Full-text search across your library [1]
• Preview without downloading [1]

Editing and annotation:

• Add text, highlights, and freehand drawings to PDFs [README]
• Direct text block editing — select and modify existing content [1]
• Add, remove, or reposition images within documents [1]
• Add signatures, accessible across devices [README]
• Manage and export highlights and comments in dedicated sections [README]

Notes and collaboration:

• Markdown notes per document (added in v0.10.0) [5][README]
• Share PDFs with external audience via link or QR code [README]
• Optional access control on shared links [README]
• Share link password protection — note: this had an authorization bypass vulnerability prior to v1.7.0, now patched [2]

Account and access:

• SSO via OIDC [README][merged profile]
• Two-factor authentication: TOTP and WebAuthn [README]
• Clean UI with dark mode, inverted color mode, custom theme colors, multiple layouts [README]

Deployment:

• Docker, Docker Compose, and Helm [README][docs]
• Lightweight enough to run on a Raspberry Pi 4 [1]
• Written in Python (67.4%), HTML (30.2%), CSS (1.4%) [merged profile]

---

Pricing: SaaS vs self-hosted math

PdfDing has no cloud tier — it’s self-hosted or nothing. The software is free (AGPL-3.0). What you’re comparing against is what you’d pay for a commercial equivalent.

Commercial PDF tools, for reference:

• Adobe Acrobat Pro: ~$19.99/month per user (subscription)
• Smallpdf Pro: ~$12/month (limited features at lower tiers)
• Nitro PDF Pro: ~$15/month per user

Self-hosting PdfDing:

• Software: $0 [README]
• VPS to run it: $5–10/month (Hetzner, Contabo, DigitalOcean — the image is small enough for the cheapest tier) [1]
• Your time: 15–30 minutes to deploy if you’re comfortable with Docker

For a team of three people who each pay for Acrobat Pro, that’s ~$60/month — $720/year — for a PDF tool that sends your documents through Adobe’s servers. A $6 VPS running PdfDing covers the whole team with no per-seat fees, no per-document limits, and no subscription that auto-renews.

The calculation is less interesting than it is for something like Zapier (where the per-task pricing creates direct, linear pain), but the principle holds: $6/month versus $19.99/user/month is roughly $167/year versus $1,440/year for a three-person team. The gap widens as the team grows.

One caveat: PdfDing doesn’t do OCR, batch processing, or conversion between formats — things Acrobat Pro does. If those are your primary use cases, the pricing comparison is misleading. You might need both PdfDing and Stirling-PDF to fully replace a commercial suite [1].

---

Deployment reality check

The image is small and the setup is straightforward. Make Tech Easier [1] notes it requires “minimal configuration” and “can easily get it running on small memory devices like Raspberry Pi 4 without any performance issues.” The documentation at docs.pdfding.com covers Docker, Docker Compose, and Helm installs with configuration options documented separately [README].

What you need:

• A Linux server or VPS — even a Raspberry Pi 4 works [1]
• Docker and docker-compose
• A domain and reverse proxy (Nginx or Caddy) if you want HTTPS for remote access
• Port mapping: pull mrmn/pdfding, map the port, done [1]

What can go sideways:

The most important issue to flag is the security vulnerability discovered in early 2026. CVE-2026-34376 (CVSS 7.5, high severity) affected all versions prior to 1.7.0. The bug: an authorization logic error in the file-serving endpoint allowed unauthenticated users to retrieve password-protected shared PDFs by calling the endpoint directly — bypassing the password verification flow entirely. No privileges required, no user interaction needed, attack vector is network [2].

This means if you set up a shared link with a password, someone could access the underlying PDF without the password on a vulnerable version. The flaw was publicly disclosed April 1, 2026 and patched in v1.7.0 [2]. If you’re running anything older, upgrade before sharing any documents externally.

Realistic setup time for a technical user: 20–30 minutes on a fresh VPS. For a non-technical founder following the docs: 1–2 hours including domain and HTTPS setup. The project’s own docs are the primary resource — third-party guides are sparse because the project is relatively young.

---

Pros and cons

Pros

• No subscription, no per-seat pricing. Free software on a $5–10/month VPS covers your whole team indefinitely [README][3].
• Reading position memory across devices. One of the genuinely useful details — you actually pick up where you stopped, on any device [README].
• Document privacy. Your PDFs stay on your server. For contracts, financial documents, or anything sensitive, this matters [1].
• Minimal and focused scope. Doesn’t try to be an office suite or processing engine. Does PDF library management well and doesn’t bloat around it [README][1].
• SSO (OIDC), 2FA (TOTP + WebAuthn). Enterprise-grade auth features available in the free self-hosted version, not gated behind a commercial license [README][merged profile].
• Markdown notes per document. Clean way to attach context or summaries to any PDF in your library [5][README].
• Lightweight enough for a Raspberry Pi. Low barrier to entry — no need for a dedicated server [1].
• Active release cadence. 42 releases with consistent feature additions tracked in community newsletters [4][5][README].
• EU-funded open source. NGI0 Commons Fund backing adds institutional stability beyond a solo side project [README].

Cons

• Not a PDF processing tool. No OCR, no batch operations, no format conversion. If you need those, add Stirling-PDF to your stack or use a different tool entirely [1].
• High-severity security vulnerability in pre-1.7.0 versions. CVE-2026-34376 allowed password-protected shared links to be bypassed. Patched, but the existence of an auth bypass in a document-sharing tool is worth flagging [2]. Verify your version before using shared links in production.
• Small community. 1,657 stars and 4 AlternativeTo likes [3][README] — the user base is small. Third-party guides are sparse, community troubleshooting forums are thin, and you’re largely relying on official docs.
• AGPL-3.0 license. Unlike MIT, AGPL requires derivative works to be released under the same license if you serve it over a network. For internal use this doesn’t matter; if you embed it in a commercial product or service, it does [3].
• Limited competitive differentiation in the write-up. The project doesn’t have the kind of published independent reviews that let you triangulate real-world pain points at scale. The data here is thinner than for more established tools.
• No offline desktop mode. Fully browser-based. If your server goes down, you can’t access your PDFs [README].

---

Who should use this / who shouldn’t

Use PdfDing if:

• You accumulate PDFs — research papers, contracts, technical docs, reference manuals — and want a searchable, organized library with real reading-position memory.
• Privacy matters: you’re not comfortable uploading financial, legal, or client documents to Adobe’s or Smallpdf’s servers.
• You want SSO and 2FA in your self-hosted PDF tool without paying for a commercial license.
• You already run other self-hosted services and adding a Docker container is routine.
• You want to share PDFs externally with optional access controls, running on infrastructure you control.

Skip it (add Stirling-PDF instead, or both) if:

• You need OCR, batch format conversion, PDF compression pipelines, or digital-signature workflows. PdfDing doesn’t do these; Stirling-PDF does [1].
• You need a desktop-first PDF editor with an offline-capable native app. Both are browser-only.

Skip it (stay on Adobe Acrobat or Smallpdf) if:

• You’re not comfortable with Docker or Linux — there’s no hosted version to fall back on.
• Your compliance team requires SOC 2 or ISO 27001 certified infrastructure and you can’t certify your own VPS.
• You need Microsoft Office-grade PDF editing (editing reflow, form creation, advanced export) — this isn’t that tier [1].

Skip it (use Nextcloud + a PDF plugin) if:

• You’re already running Nextcloud and primarily need file storage. Adding a dedicated PDF tool may be overkill unless the reading-position memory and annotation workflow are the specific gaps you’re solving.

---

Alternatives worth considering

From the AlternativeTo listing and third-party coverage:

• Stirling-PDF — the obvious complement or alternative. All-in-one PDF processing (merge, split, OCR, compress, convert, watermark). Open-source, Docker-friendly, no document management layer. Use it for batch operations; PdfDing for the reading library [1][3].
• Paperless-ngx — broader document management (not PDF-specific). Handles OCR, tagging, and indexing of all document types. Better if your problem is managing all scanned documents, not just PDFs.
• Nextcloud — full file sync suite with PDF preview and some annotation plugins. Heavier, more complex, but covers more than just PDFs.
• Zotero — research-focused reference manager with PDF annotation. Better for academic citation management; weaker for general document organization [3].
• OnlyOffice — full office suite with PDF editing that supports direct text editing, collaborative editing, and form creation [1]. Much heavier deployment, closer to a Google Docs replacement.

The realistic self-hosted shortlist for document-management-first users is PdfDing vs. Paperless-ngx. Pick PdfDing if your focus is PDFs specifically, reading experience, and cross-device continuity. Pick Paperless-ngx if you’re managing a mixed document archive with OCR requirements.

---

Bottom line

PdfDing does one thing and does it clearly: it’s a private PDF library with a real reading experience. The browser-based reader that remembers your position, the tag-and-collection organization, the annotation layer, the OIDC SSO — these are the right features for the problem of “I have 500 PDFs and can’t find or annotate anything.” It’s not a replacement for Acrobat’s processing features, and it’s not trying to be. For the target use case — founders and small teams who want their documents off of cloud services and organized somewhere they can actually use them — a $6 VPS and a 30-minute Docker setup replaces a per-user subscription that compounds as the team grows.

The CVE-2026-34376 disclosure matters and should be factored into the decision: an authorization bypass in shared-link password protection is a meaningful flaw for a document-sharing tool. It’s patched in v1.7.0. Verify your version. Beyond that specific issue, the project is actively maintained, EU-funded, and scoped narrowly enough to be trustworthy within its stated purpose.

---

Sources

1. Make Tech Easier — “Best Open-Source PDF Editor Tools You Can Host on Your Own Server”. https://www.maketecheasier.com/best-self-hosted-pdf-editor-tools/
2. OffSeq Threat Radar — “CVE-2026-34376: CWE-863: Incorrect Authorization in mrmn2 PdfDing” (disclosed April 1, 2026, patched in v1.7.0). https://radar.offseq.com/threat/cve-2026-34376-cwe-863-incorrect-authorization-in—58a5425c
3. AlternativeTo — “Open Source Apps tagged with ‘PDF Editor’” (PdfDing listing, AGPL-3.0, 4 likes). https://alternativeto.net/category/productivity/pdf-editor/?license=opensource
4. selfh.st — “This Week in Self-Hosted (29 November 2024)” — PdfDing v0.5.0 release notes. https://selfh.st/weekly/2024-11-29/
5. selfh.st — “This Week in Self-Hosted (10 January 2025)” — PdfDing v0.10.0 release notes. https://selfh.st/weekly/2025-01-10/

Primary sources:

• GitHub repository and README: https://github.com/mrmn2/PdfDing (1,657 stars, AGPL-3.0, 42 releases)
• Official website: https://www.pdfding.com
• Documentation: https://docs.pdfding.com
• Live demo: https://demo.pdfding.com