Apache PDFBox

Spec sheet

Purpose

Apache PDFBox is an open-source Java tool for creating and manipulating PDF documents and extracting content from them.Read 5 Oct 2026 · pdfbox.apache.org

Support

Users can ask usage questions on the community mailing list, while confirmed bugs and enhancement requests can be reported through the JIRA issue tracker.Read 5 Oct 2026 · pdfbox.apache.org

Founded

2002Read 28 Sep 2026 · pdfbox.apache.org

Maker

Apache PDFBox is an Apache Software Foundation project; the foundation describes itself as a U.S. 501(c)(3) charitable organization.Read 5 Oct 2026 · apache.org

Command-line tools

The project provides Java command-line utilities, including tools for encryption and decryption, image and text export, merging, splitting, rendering, printing, and PDF inspection.Read 5 Oct 2026 · pdfbox.apache.org

Dependencies

PDFBox uses Commons Logging, with Java Util Logging available as a fallback, and its fontbox and xmpbox components provide font handling and XMP metadata support.Read 5 Oct 2026 · pdfbox.apache.org

Encryption

PDFBox uses the Java Cryptography Architecture and Bouncy Castle libraries for handling PDF encryption.Read 5 Oct 2026 · pdfbox.apache.org

Integration

PDFBox can be added to an application as a Maven dependency using groupId org.apache.pdfbox and artifactId pdfbox.Read 5 Oct 2026 · pdfbox.apache.org

Java requirement

The current PDFBox 3.0 release requires Java 8; the 2.0 release requires Java 6.Read 5 Oct 2026 · pdfbox.apache.org

PDF operations

PDFBox can split or merge PDFs, fill forms, print PDFs, convert pages to images, create PDFs, and digitally sign PDFs.Read 5 Oct 2026 · pdfbox.apache.org

PDF/A validation

Its Preflight feature validates PDF files against the PDF/A-1b standard.Read 5 Oct 2026 · pdfbox.apache.org

Release verification

The download page provides PGP signatures and SHA512 checksums and says downloaded files should be verified for integrity.Read 5 Oct 2026 · pdfbox.apache.org

Security limitation

The policy excludes denial-of-service conditions limited to excessive CPU, memory, recursion, or processing time, and recommends controls such as timeouts and sandboxing for applications processing untrusted documents at scale.Read 5 Oct 2026 · pdfbox.apache.org

Security scope

The security policy treats untrusted-PDF processing issues as vulnerabilities when they cause remote code execution, security-boundary escape, or unauthorized data access.Read 5 Oct 2026 · pdfbox.apache.org

Text extraction

PDFBox can extract Unicode text from PDF files.Read 5 Oct 2026 · pdfbox.apache.org

Validation limitation

PDFBox does not automatically validate signatures, permissions, PDF/A, or other document properties unless an application explicitly invokes the relevant verification API.Read 5 Oct 2026 · pdfbox.apache.org

Plans and prices

Every Apache PDFBox plan and price →

Where Specifiction places it

• PDF SDKs#7 of 318.2