Redact thousands of PDFs in one command, on your own hardware.
The same redaction engine that runs in the browser, packaged for your server. Point it at a directory. It finds names, dates of birth, account and case numbers, addresses, emails and phone numbers, burns them out of the page, re-reads every file it wrote to prove the text is really gone, and leaves a certificate beside each one.
npx keptpdf redact ./intake -o ./produced -r
Free trial runs every feature on your first 100 files. No account, no card.
- Nothing is uploaded. Your documents are opened, changed and written by the process on your own machine.
- No network calls. Not for the work, not for the license check. Run it on an air-gapped box.
- Proof per file. Every output is re-opened and re-read. If any hidden text survives, the file is not written.
What one command actually does.
A folder of intake forms in. A folder of produced PDFs, certificates and a redaction log out.
# every PDF in ./intake, including subfolders $ keptpdf redact ./intake -o ./produced -r ✓ 2024-intake-0417.pdf 14 boxes verified ✓ 2024-intake-0418.pdf 9 boxes verified ✓ scanned-packet-22.pdf 31 boxes verified (OCR'd first) ✓ 2024-intake-0419.pdf 11 boxes verified 418 redacted, 0 skipped, 0 failed
It reads scans too
A page with no text layer is OCR'd first, then redacted like any other. Nothing about the scan is sent anywhere to make that happen.
It burns, it does not cover
The characters are removed from the content stream and the area is painted. A black rectangle drawn on top of live text is not a redaction, and that is the mistake that keeps making the news.
It refuses to ship a bad file
After writing, the output is re-opened and every string it contains is checked against what was supposed to be gone. If anything survived, no file is written and the run reports a failure.
It leaves you evidence
Each output gets a .cert.txt and .cert.json: the counts by category, the SHA-256 of the input and of the output, and the verification result.
A person can approve it before anything burns.
Redaction is not reversible. So the CLI can hand you a spreadsheet first.
$ keptpdf review ./intake -o decisions.csv
# open decisions.csv, change any wrong "keep" to "redact" (or the reverse)
$ keptpdf redact ./intake -o ./produced --apply decisions.csv
One row per candidate, with the page, the category, the confidence and the detected text. Rows above the sensitivity threshold arrive marked redact; rows below it arrive keep. An untouched file applies exactly what a plain run would have done, so adopting the review step can never quietly stop redacting something.
The review file holds the detected text, because a human has to read it to judge it. It is a working file: keep it with the sources, and never ship it with the production.
Exemption codes on the boxes, and a log that travels with the production.
FOIA and most production protocols want each black bar to say why it is there.
$ keptpdf redact ./records -o ./produced --label "(b)(6)" --log production.csv
--label stamps the code inside the box, clipped to it, never growing the redaction. --labels <file> gives a different code per category. The log records one row per box: file, page, category, code, method, confidence, position, and the certificate id.
It carries no redacted text, on purpose. The log travels with the production, so listing what you hid would undo the redaction.
KeptPDF ships no exemption preset. Which one applies is your legal call, not our default.
The commands.
keptpdf --help documents every option.
| Command | What it does |
|---|---|
keptpdf redact <input...> -o <dir> | Redact files, directories or globs. Add -r to recurse. |
keptpdf review <input...> -o <file.csv> | Write one row per candidate for a person to approve. |
keptpdf watch <in-dir> -o <out-dir> | Redact each new file dropped in a folder. A drop box for a records office. |
keptpdf categories | List the category ids for --only and --skip. |
keptpdf license | Show the license status. |
Exit codes are scriptable: 0 done, 1 at least one file failed, 2 usage error, 3 license problem. So a nightly job can fail loudly instead of quietly producing nothing.
Install it, and try it on your own files.
The trial runs every feature on your first 100 files. No account and no card to start. Trial output carries one small footer line, stamped into the page, so you can judge the redaction on your own documents before you buy. A license removes it.
$ npm install -g keptpdf $ keptpdf redact ./intake -o ./produced -r
Runs on
Windows, macOS and Linux, on Intel and ARM. Needs Node 18.17 or newer. That is the whole requirement list.
Installs clean
Two dependencies, 27 packages, no compiler and no build step. npm audit reports no known vulnerabilities.
What you install is what was tested
The PDF and OCR engines ship inside the package rather than being pulled from the registry at install time.
Works offline
Once installed there is nothing left to reach. The license is checked with an offline signature, so a batch that runs overnight cannot be stopped by someone else's server being down.
Why not just call a redaction API?
Because the documents you most need to redact are the ones you least want to send anywhere.
| KeptPDF CLI | Cloud redaction API | By hand in a PDF editor | |
|---|---|---|---|
| Where the document goes | Nowhere. It is opened by your own process. | Uploaded to someone else's servers | Stays on the machine |
| Vendor contract needed before you can start | No | Usually yes | No |
| Files per hour | Hundreds, unattended | Hundreds, plus upload time | A few dozen, with a person |
| Output re-read to prove the text is gone | Yes, every file | Rarely | No |
| Certificate with input and output hashes | Yes | Sometimes | No |
| Human approval step before it burns | Yes, a CSV | No | It is all human |
| Exemption codes stamped in the box | Yes | Rarely | Manual |
| Runs air-gapped | Yes | No | Yes |
| Cost of 50,000 pages | The license. Volume changes nothing. | Per page or per document | Weeks of someone's time |
There is a second reason, and it is the one that decides most procurement conversations: a redaction API adds a party to the chain of custody for the exact documents where the chain of custody is the point. Medical records, personnel files, discovery, benefits claims, police reports. Running the work on your own hardware removes that conversation instead of documenting it.
One price. One organization. Unlimited files.
Never per page, and never per seat. You are running a batch, not buying chairs.
$2,400/year
One organization, unlimited files, your own hardware.
- Every command, every category, no page or volume cap
- OCR for scanned pages, included
- Review-and-approve workflow
- Exemption codes and the production log
- A certificate for every file
- Offline license key. Nothing to phone home to
- Email support at support@keptpdf.com
Yearly, renews automatically, cancel any time from the receipt Stripe emails you.
Buy a license
Your organization name is signed into the key, so type it the way you want it recorded. The key is emailed the moment payment clears.
This form sends only what you type here. We never receive a document.
Not ready? The trial is the full tool on your first 100 files, with no time limit on when you use them. Output carries one footer line until you license it. Run it on your own documents first: npm install -g keptpdf
Questions people ask before they buy.
Does anything leave the machine?
No. The CLI makes no network calls of any kind. Not to redact, not to OCR, and not to check its license, which is verified with an offline signature. It runs on an air-gapped server. This is different from the KeptPDF website, which does your document work in the browser but makes small first-party calls for the daily quota and analytics. The CLI makes none.
How do I know the text is actually gone?
The tool proves it to itself before it writes. Each output is re-opened and re-read, and every string it still contains is checked against what was supposed to be removed. If anything survived, the file is not written at all and the run reports a failure. The certificate beside each output records that result along with the SHA-256 of the input and the output.
What does it detect?
Names, dates of birth and other personal dates, account and case and policy numbers, Social Security numbers, addresses, emails, phone numbers, and more. You can narrow it with --only or widen it with your own terms. keptpdf categories lists every category id.
What happens with scanned documents?
Pages with no text layer are OCR'd first, on your machine, then redacted like any other page. The OCR engine ships inside the package, so there is nothing to download at run time.
Is a machine ever going to catch everything?
No, and we will not claim it does. That is exactly why keptpdf review exists: it writes one row per candidate so a person can approve the decisions before anything burns. What we do claim, and prove per file, is that whatever you did decide to redact is genuinely gone from the output.
What operating systems does it run on?
Windows, macOS and Linux, on both Intel and ARM. It needs Node 18.17 or newer and nothing else. There is no compiler step and no native build at install time.
Can I try it before paying?
Yes. npm install -g keptpdf and run it. The trial has every feature enabled and covers your first 100 files, with no account and no card. That is 100 files in total, not per run, and there is no deadline to spend them. The count is kept in a plain file on your own machine and is never sent anywhere. Trial output carries one small footer line naming it as trial output, so it is not fit to file or produce. It is stamped into the page as an image rather than as text, so the audit certificate still reads zero extractable characters with nothing excluded from the count. A license key removes it.
How does licensing work across our servers?
One license covers one organization. Put the key on as many of your own machines as you need, including build agents and scheduled jobs. There is no seat count, no activation, and no server to check in with.
What happens when the license expires?
The key carries an expiry date and the tool falls back to trial limits after it. Renewal is automatic while the subscription is active, and a fresh key is emailed each year.
Is it the same redaction engine as the website?
Yes. The CLI runs the same detection and burn-in code that runs in the browser, packaged for Node. That is deliberate: the free web tool is where the engine gets tested against real documents every day.
Can we get an invoice or pay by purchase order?
Checkout issues a proper invoice through Stripe with your billing address on it, which most finance teams accept as-is. If your organization needs a PO or a W-9 first, email support@keptpdf.com and we will send one.
Is there an API or a library instead of a CLI?
The CLI is the supported surface today. If you need to call it in-process rather than shelling out, tell us what you are building at support@keptpdf.com. It shapes what we ship next.
Try it on your own files tonight.
The trial is the whole tool. Nothing about your documents reaches us either way.