Redact thousands of PDFs in one command, on your own hardware.
The same redaction engine that runs in the browser, packaged for your server. Point it at a directory. It finds names, dates of birth, account and case numbers, addresses, emails and phone numbers, burns them out of the page, re-reads every file it wrote to prove the text is really gone, and leaves a certificate beside each one.
npx keptpdf redact ./intake -o ./produced -r
Free trial runs on your first 100 files. No account, no card.
- Nothing is uploaded. Your documents are opened, changed and written by the process on your own machine.
- No network calls. Not for the work, not for the license check. Run it on an air-gapped box. The one exception is yours to invoke:
keptpdf updateasks keptpdf.com for the newest version number (sending only the version you have and your operating system), then installs it from npm, and only when you run it. - Proof per file. Every output is re-opened and re-read. If any hidden text survives, the file is not written.
What one command actually does.
A folder of intake forms in. A folder of produced PDFs, certificates and a redaction log out.
# every PDF in ./intake, including subfolders $ keptpdf redact ./intake -o ./produced -r ✓ 2024-intake-0417.pdf 14 boxes verified ✓ 2024-intake-0418.pdf 9 boxes verified ✓ scanned-packet-22.pdf 31 boxes verified (OCR'd first) ✓ 2024-intake-0419.pdf 11 boxes verified 418 redacted, 0 skipped, 0 failed
It reads scans too
A page with no text layer is OCR'd first, then redacted like any other. Nothing about the scan is sent anywhere to make that happen.
Word and Excel go in as-is
.docx, .xlsx, .pptx and their older and OpenDocument cousins are converted to PDF on your machine (via your installed LibreOffice), then redacted like any other file. Spreadsheet columns are auto-widened first, so a narrow column cannot clip an SSN out of detection's sight.
It burns, it does not cover
The characters are removed from the content stream and the area is painted. A black rectangle drawn on top of live text is not a redaction, and that is the mistake that keeps making the news.
It refuses to ship a bad file
After writing, the output is re-opened and every string it contains is checked against what was supposed to be gone. If anything survived, no file is written and the run reports a failure.
It leaves you evidence
Each output gets a .cert.txt and .cert.json (and a branded .cert.pdf on licensed runs): the counts by category, the SHA-256 of the input and of the output, and the verification result.
Searchable, without the risk
Redacted pages are flattened to images. --searchable adds a text layer back by reading the finished redacted pages with OCR, after the verification pass, so the layer cannot contain what was removed.
A person can approve it before anything burns.
Redaction is not reversible. So the CLI can hand you a spreadsheet first.
$ keptpdf review ./intake -o decisions.csv
# open decisions.csv, change any wrong "keep" to "redact" (or the reverse)
$ keptpdf redact ./intake -o ./produced --apply decisions.csv
One row per candidate, with the page, the category, the confidence and the detected text. Rows above the sensitivity threshold arrive marked redact; rows below it arrive keep. An untouched file applies exactly what a plain run would have done, so adopting the review step can never quietly stop redacting something.
The review file holds the detected text, because a human has to read it to judge it. It is a working file: keep it with the sources, and never ship it with the production.
Exemption codes on the boxes, and a log that travels with the production.
FOIA and most production protocols want each black bar to say why it is there.
$ keptpdf redact ./records -o ./produced --label "(b)(6)" --log production.csv
--label stamps the code inside the box, clipped to it, never growing the redaction. --labels <file> gives a different code per category. A code column in the review file sets it per box, so one document can cite (b)(6) on one bar and (b)(7)(C) on the next. The log records one row per box: file, page, category, code, method, confidence, position, and the certificate id.
It carries no redacted text, on purpose. The log travels with the production, so listing what you hid would undo the redaction.
KeptPDF ships no exemption preset. Which one applies is your legal call, not our default.
One stack goes in. The documents inside it come out, each one named.
A production, an intake packet, a personnel file. Somebody has been doing this by hand, finding where page 47 stops being one thing and starts being another.
$ keptpdf split ./Intake-Packet.pdf -o ./documents --auto + Intake-Packet.pdf 6 documents in 85 pages 1.1s 1. pages 1-10 Master Services Agreement 2. pages 11-17 Certificate of Insurance 3. pages 18-27 Statement of Work 4. pages 28-44 Vendor Questionnaire 5. pages 45-61 Certificate of Insurance 6. pages 62-85 Change Order 3
It reads the pages and works out where one document ends and the next begins, then names each file from that document's own title rather than from the stack it arrived in. Add --read-scans and it reads the scanned pages first, so a stack that came straight off a scanner splits too.
You do not have to take its word for it. --review holds everything back and walks you through the list: rename a document, join it to the one above, split it in two, or leave it out. Nothing is written until you say write. --dry-run prints the whole list and writes nothing at all.
The trial reads a file of any length and lists every document it finds. It saves the ones inside the first 50 pages. A license key writes them all.
The commands.
keptpdf --help documents every option.
| Command | What it does |
|---|---|
keptpdf redact <input...> -o <dir> | Redact files, directories or globs. Add -r to recurse. |
keptpdf review <input...> -o <file.csv> | Write one row per candidate for a person to approve. |
keptpdf watch <in-dir> -o <out-dir> | Redact each new file dropped in a folder. A drop box for a records office. |
keptpdf split <input...> -o <dir> --auto | Find the documents inside one PDF and write each one out, named from its own title. Add --review to fix the list first. |
keptpdf split <input...> -o <dir> | Copy pages out yourself: --pages "1,3-5" or --every 1 for one PDF per page. |
keptpdf bates <input...> -o <dir> | Stamp continuous Bates numbers on PDFs: --prefix, --start, --digits, --designation, --restamp, and --combined for one PDF with numbering that runs across the file list. Writes a range report beside the output. |
keptpdf categories | List the category ids for --only and --skip. |
keptpdf license | Show the license status. |
Exit codes are scriptable: 0 done, 1 at least one file failed, 2 usage error, 3 license problem. So a nightly job can fail loudly instead of quietly producing nothing.
Install it, and try it on your own files.
The trial runs on your first 100 files. No account and no card to start. Trial output carries one small footer line, stamped into the page, so you can judge the redaction on your own documents before you buy. A license removes it. Splitting by document reads every page of any file and lists every document it finds, and saves the ones inside the first 50 pages.
$ npm install -g keptpdf $ keptpdf redact ./intake -o ./produced -r
Runs on
Windows, macOS and Linux, on Intel and ARM. Needs Node 18.17 or newer. That is the whole requirement list.
Installs clean
Two dependencies, 27 packages, no compiler and no build step. npm audit reports no known vulnerabilities.
What you install is what was tested
The PDF and OCR engines ship inside the package rather than being pulled from the registry at install time.
Works offline
Once installed there is nothing left to reach. The license is checked with an offline signature, so a batch that runs overnight cannot be stopped by someone else's server being down.
Why not just call a redaction API?
Because the documents you most need to redact are the ones you least want to send anywhere.
| KeptPDF CLI | Cloud redaction API | By hand in a PDF editor | |
|---|---|---|---|
| Where the document goes | Nowhere. It is opened by your own process. | Uploaded to someone else's servers | Stays on the machine |
| Vendor contract needed before you can start | No | Usually yes | No |
| Files per hour | Hundreds, unattended | Hundreds, plus upload time | A few dozen, with a person |
| Output re-read to prove the text is gone | Yes, every file | Rarely | No |
| Certificate with input and output hashes | Yes | Sometimes | No |
| Human approval step before it burns | Yes, a CSV | No | It is all human |
| Exemption codes stamped in the box | Yes | Rarely | Manual |
| Runs air-gapped | Yes | No | Yes |
| Cost of 50,000 pages | The license. Volume changes nothing. | Per page or per document | Weeks of someone's time |
There is a second reason, and it is the one that decides most procurement conversations: a redaction API adds a party to the chain of custody for the exact documents where the chain of custody is the point. Medical records, personnel files, discovery, benefits claims, police reports. Running the work on your own hardware removes that conversation instead of documenting it.
Measured accuracy per corpus, weak results included: see the benchmarks page.
One price. One organization. Unlimited files.
Never per page, and never per seat. You are running a batch, not buying chairs.
$4,800/year
One organization, unlimited files, your own hardware.
- Every command, every category, no page or volume cap
- OCR for scanned pages, included
- Review-and-approve workflow
- Exemption codes and the production log
- A certificate for every file
- Offline license key. Nothing to phone home to
- Email support at support@keptpdf.com
Yearly, renews automatically, cancel any time from the receipt Stripe emails you.
Buy a license
Your organization name is signed into the key, so type it the way you want it recorded. The key is emailed the moment payment clears.
This form sends only what you type here. We never receive a document.
Try it on 100 files first
The trial covers your first 100 files, with no time limit on when you use them. It runs on your own machine and needs no account. Output carries one footer line until you license it.
npm install -g keptpdf
Try it on 500 files
A free trial key comes by email and runs on up to 500 files. No card, no call.
One key per address and per organization. This form sends only what you type here. We never receive a document.
Not buying today?
This one goes to a person, not a payment page. Tell us what you need and you get an email back from someone who can arrange it.
This form sends only what you type here. We never receive a document.
Solution providers: buy the license on your client's behalf. Each client gets its own key, signed to their name, and every certificate the tool produces names that organization. The partner code takes 25% off the first year ($3,600 instead of $4,800); you bill your client at your own rate and keep the difference. Renewals are at list price. Email support@keptpdf.com for the code.
Questions people ask before they buy.
Does anything leave the machine?
No. The CLI makes no network calls on its own. Not to redact, not to OCR, and not to check its license, which is verified with an offline signature. It runs on an air-gapped server. The one exception is opt-in: keptpdf update (or setting KEPTPDF_UPDATE_CHECK=1) asks keptpdf.com for the newest version number. It sends only the version you have and your operating system name, and nothing about you, your machine or your documents. If keptpdf.com cannot be reached it asks npm's public registry instead. If there is a newer version, the command then installs it from npm the way you would have, by running npm install -g keptpdf in front of you. Use keptpdf update --check to see the answer and install nothing. This is different from the KeptPDF website, which does your document work in the browser but makes small first-party calls for the daily quota and analytics.
How do I know the text is actually gone?
The tool proves it to itself before it writes. Each output is re-opened and re-read, and every string it still contains is checked against what was supposed to be removed. If anything survived, the file is not written at all and the run reports a failure. The certificate beside each output records that result along with the SHA-256 of the input and the output.
What does it detect?
Names, dates of birth and other personal dates, account and case and policy numbers, Social Security numbers, addresses, emails, phone numbers, and more. You can narrow it with --only or widen it with your own terms. keptpdf categories lists every category id.
Can it take Word or Excel files?
Yes. Office inputs (.doc, .docx, .xls, .xlsx, .ppt, .pptx, .odt, .ods, .odp, .rtf) are converted to PDF on your machine first, using your installed copy of LibreOffice, then redacted like any other input. Nothing is bundled and nothing is uploaded; if LibreOffice is missing, the run tells you up front where to get it.
What happens with scanned documents?
Pages with no text layer are OCR'd first, on your machine, then redacted like any other page. The OCR engine ships inside the package, so there is nothing to download at run time.
Is a machine ever going to catch everything?
No, and we will not claim it does. That is exactly why keptpdf review exists: it writes one row per candidate so a person can approve the decisions before anything burns. What we do claim, and prove per file, is that whatever you did decide to redact is genuinely gone from the output.
What operating systems does it run on?
Windows, macOS and Linux, on both Intel and ARM. It needs Node 18.17 or newer and nothing else. There is no compiler step and no native build at install time.
Can I try it before paying?
Yes. npm install -g keptpdf and run it. The trial covers your first 100 files, with no account and no card. That is 100 files in total, not per run, and there is no deadline to spend them. The count is kept in a plain file on your own machine and is never sent anywhere. Trial output carries one small footer line naming it as trial output, so it is not fit to file or produce. It is stamped into the page as an image rather than as text, so the audit certificate still reads zero extractable characters with nothing excluded from the count. A license key removes it. Splitting by document has one more limit: the trial reads every page of a file of any length and lists every document it finds, then saves the documents that fit inside the first 50 pages. Add --dry-run and it prints the whole answer on any file, since it writes nothing.
How does licensing work across our servers?
One license covers one organization. Put the key on as many of your own machines as you need, including build agents and scheduled jobs. There is no seat count, no activation, and no server to check in with.
We run document workflows for our clients. Whose license do we buy?
Your client's, bought by you. A license covers the organization named in the key, and every certificate the tool produces prints that name, so one client's key does not fit another client's work. A provider serving three clients buys three licenses, each in the client's name, and operates the software under them. Switching clients is just a folder: the tool reads keptpdf-license.txt from the directory it runs in before the machine-wide key, so keep one folder per client with that client's key inside it and the right name lands on every certificate. You can also point any run at a key directly with --license <file>. Either way, every licensed run prints which key it used, and keptpdf license lists every key it can see and which one wins, so a wrong-client mix-up shows up before anything ships. The deal: email support@keptpdf.com for the partner code, enter it at checkout, and pay $3,600 instead of $4,800 for each new client's first year. You bill your client at your own rate; the difference is your margin. Renewals are at list price.
What happens when the license expires?
The key carries an expiry date and the tool falls back to trial limits after it. Renewal is automatic while the subscription is active, and a fresh key is emailed each year.
Is it the same redaction engine as the website?
Yes. The CLI runs the same detection and burn-in code that runs in the browser, packaged for Node. That is deliberate: the free web tool is where the engine gets tested against real documents every day.
Can we get an invoice or pay by purchase order?
Checkout issues a proper invoice through Stripe with your billing address on it, which most finance teams accept as-is. If your organization needs a PO or a W-9 first, email support@keptpdf.com and we will send one.
Is there an API or a library instead of a CLI?
The CLI is the supported surface today. If you need to call it in-process rather than shelling out, tell us what you are building at support@keptpdf.com. It shapes what we ship next.
Try it on your own files tonight.
The trial runs on your own documents. Nothing about them reaches us either way.