Client-side PDF merge and split without a document server

What is a PDF catalog versus a page tree?

Trailer /Root points at the catalog. /Pages is a tree of kids that are pages or nested nodes. Resources (fonts, XObjects) inherit. Merge tools that only concatenate file bytes produce invalid documents. ISO 32000 cares about object identity, not file order. Merge PDF has to copy pages, not cat the files.

Annotations, destinations, and AcroForm fields live in other dictionaries. copyPages copies page dictionaries and resources; widgets can dangle. Test the output. If you needed a subset of pages in one file, extract PDF pages is closer than a naive split of byte ranges.

How does pdf-lib copyPages work?

Load each PDFDocument from an ArrayBuffer. copyPages(src, indices) clones page objects into the target, remapping references. Font subsets may duplicate. Shared XObjects can bloat. Incremental updates in the source are flattened on save() unless you opt into a different writer.

const a = await PDFDocument.load(bytesA);
const b = await PDFDocument.load(bytesB);
const pages = await a.copyPages(b, b.getPageIndices());
pages.forEach((p) => a.addPage(p));
const out = await a.save();

What breaks on encrypted or linearized PDFs?

Linearized (“fast web view”) files still parse, but object streams and xref streams must be understood. Password-protected files need the user password at load. Previous revisions in incremental saves can leak pages you thought you dropped — the same class of bug as fake redaction.

Prove the tool did not upload the packet with a Network-tab audit. Corporate packets are why uploading converters is a DLP incident even if merge “works.”

Split strategies that are not byte ranges

Extract page indices into a new PDFDocument. One file per range (split PDF), or one file with a subset (extract pages). File.slice on the container is only valid for non-PDF binaries. For PDFs it is corruption. Blob slicing is still useful to avoid holding ten 80 MB ArrayBuffers at once: load, copy, drop, next.

Memory ceilings

Each source PDF is an ArrayBuffer. Ten 80 MB reports will crash a phone tab. Revoke object URLs after download. Process sequentially. pdf-lib cannot mmap. If you only needed images of pages, that is raster (canvas) and a different quality/privacy tradeoff.

Related PDF jobs

Merge, split, extract, delete, and rotate are page-tree edits. Redaction is content-stream destruction. Metadata wipe is Info/XMP. Do not pick merge when you meant redact. Data minimization is why these jobs stay in the tab.

• Merge PDF
• Split PDF
• Extract pages
• PDF redactor

Worked example: contract pack without a merge SaaS

You have a master MSA and three exhibits. Open merge PDF, add in order, download. Sequential load if they are large (Blob slicing). Open Network first (audit). If you needed only pages 2–5 of an exhibit, extract pages or split before merge.

If the pack contains names you must destroy, merge does nothing to operators. Redact on the source, then merge. Black boxes are not redaction. Uploading the unredacted original to a “PDF editor” is the incident, even if they paint well — cloud converters and telemetry.

Password-protected exhibits: unlock locally if you have the password, merge, optionally re-lock with password protect PDF. Do not send the password and the file to the same website.

After download, search the output for a distinctive string you expected to keep. If pages are missing, you copied the wrong indices, not “PDF magic.” Catalog edits are exact. Minimization is why this workflow never needed a document server.

Frequently asked questions