Put PDF pages in order,
without sending them anywhere.

Where your files go: nowhere

A file you add is read by your browser, from your device, into this tab. The scripts of this desk contain no upload, no request that carries anything of yours, and no storage: there is nothing in them that could send a page, a file name or a byte, and nothing about your files is kept when you close the tab (the site remembers two choices of yours in this browser: the paper or dark skin, and whether the small notices are on). The page was tested with the network cut after loading: adding, arranging and downloading all work, pictures included, with the one exception described next. The download is a file your browser writes straight from the tab’s memory.

One thing is fetched later, and only if a file needs it. The first time a page stores a picture as a black-and-white scan (CCITT fax or JBIG2) or as JPEG 2000, pdf.js asks this site for its decoder: a script of 152 kB for the scans, 446 kB for JPEG 2000. That request names the script and carries nothing of your file, and a file with no such picture never causes it. With the network cut it fails; the page then shows its number in place of its picture, the desk says so, and everything else works as before.

What the page does send. Like every page of this site it counts visits with Google Analytics: that the page was opened, that one of its controls was first used, that thirty seconds passed with the page in use, and how quickly the page painted and answered (three timings, with the kind of page element involved, never its content). Those signals carry the page’s address and nothing about a file: no name, no size, no page. The site’s search and assistant, in the menu, ask the server only when you use them. Legal has the whole note.

The two libraries

Both are open source, served from this site (not from a third party), unmodified, in the versions named here.

• pdf-lib 1.17.1, by Andrew Dillon, MIT licence (the licence, pdf-lib.js.org). It reads each PDF and writes the new one. Every structural step — copying a page, turning it, leaving one out — is its work.
• pdf.js 6.4.299 (legacy build), by Mozilla, Apache License 2.0 (the licence, mozilla.github.io/pdf.js). It only draws the small page pictures, in a worker of its own. It never touches the result. If it cannot start in a browser, the desk says so and works by page number instead.
• pdf.js’s two decoders for scans, from the same package and version, as plain JavaScript (nothing is compiled from WebAssembly). The one for CCITT fax and JBIG2, the black-and-white codings of office scanners, is built by Mozilla (Apache License 2.0: the licence) from the PDFium project’s code (BSD 3-Clause and Apache License 2.0: the licence). The one for JPEG 2000 is Mozilla’s build (BSD 2-Clause: the licence) of OpenJPEG (BSD 2-Clause: the licence). Neither loads with the page; each is fetched from this site the first time a file needs it, and draws only the picture on the desk.

The list of the files as shipped, with the SHA-256 of each. Everything else on this desk was written for it.

How the new file is made

Your files are never edited. The result is a new document that receives a copy of each page you kept, in your order, with your turns added to the turn the page already had. A page is copied whole — its text, fonts, pictures and vector drawing exactly as they were; nothing is re-drawn, re-compressed or turned into a picture.

A page you left out is not inside the result — and that takes work, because a careless copy of one page carries others along, invisibly, by three roads. A page can link to other pages (a contents page links to every chapter): here a link to a page that is not in the result is taken off. Many files keep one list of pictures and fonts for all their pages: here every page you keep gets a list of its own, naming only what its own drawing uses, so the pictures of the other pages stay behind. And a form field can have boxes on several pages: a box you keep no longer points at boxes, or values, on pages you left out. Then everything the result does not use is removed, and the page objects in the file are counted: there must be exactly as many as pages you kept.

The outcome of that check is printed under the Download button every time. If a page’s drawing is packed in a way this desk cannot read, its list is kept whole rather than guessed at, and the line under the button says so instead of making the promise. What a kept page itself holds always comes along: its own pictures, notes and form boxes, and anything a program stored privately on that page.

What survives, and what does not

• Page content, size and turn: kept exactly. Links to web addresses, and links between pages that are both in the result: kept.
• Fillable forms: when the result is made from one file, its form comes along and the fields on the pages you kept can still be filled in; fields whose boxes were all on pages you left out are dropped. When the result mixes files, fields stay on the page as they look — filled-in values that the file stored as drawings remain visible — and can no longer be filled in.
• Digital signatures: do not survive, here or in any tool. A signature certifies the exact bytes of the signed file, and a new file has other bytes. The signature’s picture stays on its page; a viewer will report the signature itself as invalid or absent.
• Bookmarks (the outline), page labels, attached files and the tags screen readers use: not carried over. Title, author, subject and keywords are carried when the result comes from one file.
• Pictures added as pages: a JPEG is placed byte for byte as it is; a PNG is unpacked and packed again without loss. Each gets a page of its own shape, 0.75 point to the pixel, never longer than an A4 sheet (842 points). A photo’s stored orientation is honoured by turning its page.

What this desk cannot do

• Password-protected files. An encrypted PDF is refused with a sentence — also one that opens without a password but restricts printing or copying, because it is encrypted all the same. The desk does not remove passwords.
• Scans are pictures, not text. A scanned page stays a picture of a page: it can be moved and turned, but there is no text in it to find or copy, and this desk does not read text out of pictures (no OCR).
• No compression. There is no “make it smaller” key, because the honest ways to shrink a PDF re-encode its pictures at a loss. A result is about the size of the pages in it; splitting off a few pages gives a smaller file only because it holds fewer pages.
• No editing inside a page: no text changes, cropping, page numbers, watermarks or redaction.
• Damaged files. A file that is cut short or broken is refused with a sentence that says so; the desk does not try to repair it.
• Some page pictures. The small pictures are drawn without pdf.js’s font files, so text in a font the PDF does not carry is shown in a substitute. Black-and-white scans (CCITT fax, JBIG2) and JPEG 2000 pictures are drawn by pdf.js’s own decoders, fetched from this site when a file first needs one. If a decoder cannot be fetched or does not run, a page that is nothing but such a picture shows its number on the desk in place of a picture, a page with other content shows without it, and the desk says so. Either way that is the picture on the desk only; the page in the result is the original, and other readers draw it.

How large a file

Measured, 7 October 2026, in Chrome’s test browser on a Mac with its processor slowed four times and a phone-sized window: a PDF of 300 pages and 104 MB was put on the desk in under a second; 200 of its pages were turned and written to a new 69 MB file in a little over two seconds; the longest the page stopped answering was about a third of a second. Pictures are drawn only for the pages in view, so 300 pages do not mean 300 drawings at once.

Memory is the limit, not time. While that file was written the browser’s memory rose by about 1.1 GB: roughly ten times the size of the files being written, because the pages are held once as read, once as copied and once as the finished file. A computer has that to spare for files of 100 MB and more. A phone gives a tab far less, so on a phone count on a few tens of megabytes; past that the browser may close the tab, and the work on the desk is lost with it. The slowed processor was measured; a real phone’s memory was not.

Between adding and saving the desk itself does not hold a file: it is read again from your device when you press Download, so do not move or rename it meanwhile. While page pictures are being drawn, pdf.js holds a copy of each file it is drawing from; a few seconds after the last picture is drawn it lets them go, and opens a file again when you scroll to pages it has not drawn yet.

Other desks in this room

OmniFile converts pictures, audio, video and text between formats; Diff & Crate compares two files and opens a zip; File Search searches a folder on your own disk; Glass reads every byte of a photo; Watermark finds the characters you cannot see in a text. None of them merges or splits a PDF; all of them, like this one, work without an upload.