DEV Community

IronSoftware
IronSoftware

Posted on

iTextSharp is Abandoned — Upgrade to IronPDF in 2025

#csharp #dotnet

iTextSharp hasn't been updated since 2016. The project was discontinued and replaced by iText 7, a completely different API that requires rewriting your code from scratch.

If you're still using iTextSharp (the 5.x version), you're running abandoned software with known security vulnerabilities, no bug fixes, and no support for modern .NET.

Here's why iTextSharp is dead, and why upgrading to IronPDF makes more sense than migrating to iText 7.

Why Was iTextSharp Abandoned?

The Fork That Broke Everything

In 2016, iText Software (the company behind iTextSharp) made a controversial decision:

  1. Stopped development on iTextSharp 5.x (the C# port of iText for Java)
  2. Released iText 7 — a completely rewritten library with a different API
  3. Changed licensing from LGPL (permissive) to AGPL (requires open-sourcing your app)
  4. Forced commercial licensing for any proprietary use

The result: Millions of developers using iTextSharp 5.x were left with:

  • No updates or bug fixes
  • Security vulnerabilities unfixed
  • No .NET Core/.NET 5+ support
  • No migration path (iText 7 requires complete code rewrite)

iTextSharp 5.x is Frozen (2016-Present)

Last stable release: iTextSharp 5.5.13.3 (January 2019, minor bug fix)
Last major release: iTextSharp 5.5.0 (2016)

What this means:

  • 9+ years without feature updates
  • No support for .NET Core, .NET 5, .NET 6, .NET 8, .NET 10
  • No fixes for modern PDF security issues
  • No support for UTF-8 improvements in C# 11/12
  • No async/await improvements
  • Runs on .NET Framework only (legacy platform)

If you're using iTextSharp 5.x, you're running 9-year-old software with known bugs.

Security Risks of Using Abandoned Software

Known Vulnerabilities in iTextSharp 5.x

CVE-2020-15522 (CVSS 7.5): XML External Entity (XXE) injection in iText 5.x allows attackers to read arbitrary files from the server.

Status in iTextSharp 5.x: Never fixed (project abandoned before CVE was published).

Fixed in: iText 7.1.12 (2020) — requires complete code rewrite to upgrade.

Fixed in IronPDF: Not vulnerable (different architecture).

Compliance Risks

If you're subject to compliance standards:

  • PCI-DSS: Requires patching known vulnerabilities within 30 days
  • SOC 2: Requires up-to-date software dependencies
  • HIPAA: Requires security patches for software handling PHI
  • ISO 27001: Requires vulnerability management

Using iTextSharp 5.x fails these audits.

Why Not Upgrade to iText 7?

iText 7 is the "official" successor to iTextSharp, but it has major problems:

1. Complete API Rewrite (No Backward Compatibility)

iTextSharp 5.x code:

using iTextSharp.text;
using iTextSharp.text.pdf;
// Install via NuGet: Install-Package iTextSharp (abandoned)

Document document = new Document();
PdfWriter writer = PdfWriter.GetInstance(document, new FileStream("output.pdf", FileMode.Create));
document.Open();
document.Add(new Paragraph("Hello World"));
document.Close();
Enter fullscreen mode Exit fullscreen mode

iText 7 equivalent:

using iText.Kernel.Pdf;
using iText.Layout;
using iText.Layout.Element;
// Install via NuGet: Install-Package itext7 (AGPL license)

PdfWriter writer = new PdfWriter("output.pdf");
PdfDocument pdf = new PdfDocument(writer);
Document document = new Document(pdf);
document.Add(new Paragraph("Hello World"));
document.Close();
Enter fullscreen mode Exit fullscreen mode

The API is completely different:

  • Different namespaces (iTextSharp.text → iText.Kernel.Pdf)
  • Different class names (Document → PdfDocument + Document)
  • Different method calls (document.Open() no longer exists)
  • Different PDF manipulation approaches

Migration requires rewriting every line of iTextSharp code.

2. AGPL Licensing Trap

iTextSharp 5.x: LGPL (allowed proprietary use with limitations)

iText 7: AGPL (requires open-sourcing your entire application)

What AGPL means:

  • If you use iText 7 in a web application, you must open-source your entire codebase
  • Commercial license costs $1,800+ per developer per year
  • No free option for proprietary software (even for internal tools)

This is license ransomware. See my article Why AGPL Software Like iText Isn't Free for details.

3. Expensive Commercial Licensing

iText 7 commercial pricing (2025):

  • Standard license: $1,800 per developer per year
  • OEM/SaaS license: $10,000+ per year
  • Enterprise license: Custom pricing (often $50,000+)

IronPDF pricing:

  • $749 per developer (one-time, perpetual license)
  • No annual renewals required
  • Free updates for first year

Cost comparison (5 developers, 3 years):

Library Year 1 Year 2 Year 3 Total
iText 7 $9,000 $9,000 $9,000 $27,000
IronPDF $3,745 $0 $0 $3,745

IronPDF saves $23,255 (86%) over 3 years.

4. Still Poor HTML Support

iText 7 has better HTML support than iTextSharp 5.x, but it's still behind modern libraries.

What iText 7 still doesn't support:

  • Flexbox (Bootstrap 4/5 layouts break)
  • CSS Grid
  • JavaScript execution
  • Modern CSS selectors (:nth-child, :not, attribute selectors)
  • CSS variables (var())

IronPDF supports all of this (Chromium-based rendering).

Why Upgrade to IronPDF Instead?

1. Modern .NET Support

IronPDF supports:

  • ✅ .NET Core 3.1, .NET 5, .NET 6, .NET 8, .NET 10
  • ✅ .NET Framework 4.6.2+
  • ✅ Linux, macOS, Windows
  • ✅ Docker, Kubernetes, Azure, AWS
  • ✅ Blazor, ASP.NET Core, WPF, WinForms, Console apps

iTextSharp 5.x supports:

  • ❌ .NET Framework only (legacy platform)
  • ❌ No .NET Core/.NET 5+ support
  • ❌ Windows-only (no Linux/macOS)

2. Simple Migration Path

Migrating from iTextSharp to IronPDF is easier than migrating to iText 7.

iTextSharp 5.x HTML to PDF:

using iTextSharp.text;
using iTextSharp.text.pdf;
using iTextSharp.tool.xml;
// Install via NuGet: Install-Package iTextSharp (abandoned)

var html = "<h1>Hello World</h1>";
var htmlStream = new MemoryStream(System.Text.Encoding.UTF8.GetBytes(html));

using var pdfStream = new FileStream("output.pdf", FileMode.Create);
var document = new Document();
var writer = PdfWriter.GetInstance(document, pdfStream);
document.Open();

XMLWorkerHelper.GetInstance().ParseXHtml(writer, document, htmlStream, null);
document.Close();
Enter fullscreen mode Exit fullscreen mode

IronPDF equivalent:

using IronPdf;
// Install via NuGet: Install-Package IronPdf

var html = "<h1>Hello World</h1>";

var renderer = new [ChromePdfRenderer](https://ironpdf.com/blog/videos/how-to-render-html-string-to-pdf-in-csharp-ironpdf/)();
var pdf = renderer.RenderHtmlAsPdf(html);
pdf.SaveAs("output.pdf");
Enter fullscreen mode Exit fullscreen mode

80% less code, same result.

Compare to iText 7:

using iText.Html2Pdf;
using iText.Kernel.Pdf;
// Install via NuGet: Install-Package itext7 (AGPL)
// Requires commercial license for proprietary use

var html = "<h1>Hello World</h1>";
var htmlStream = new MemoryStream(System.Text.Encoding.UTF8.GetBytes(html));

using var pdfWriter = new PdfWriter("output.pdf");
using var pdfDocument = new PdfDocument(pdfWriter);

HtmlConverter.ConvertToPdf(htmlStream, pdfDocument);
Enter fullscreen mode Exit fullscreen mode

iText 7 still requires verbose stream management and licensed add-ons.

3. Better HTML/CSS Rendering

iTextSharp 5.x HTML support: Extremely limited, only basic HTML 3.2-era tags.

iText 7 HTML support: Better, but still missing modern CSS (no flexbox, grid, variables).

IronPDF HTML support: Full HTML5/CSS3 support (Chromium rendering engine).

Example that breaks in iText 5.x and iText 7:

<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
<div class="container">
    <div class="row">
        <div class="col">Column 1</div>
        <div class="col">Column 2</div>
        <div class="col">Column 3</div>
    </div>
</div>
Enter fullscreen mode Exit fullscreen mode

iTextSharp 5.x result: Crashes or renders nothing (no Bootstrap support).

iText 7 result: Three rows stacked vertically (no flexbox support).

IronPDF result: Three side-by-side columns (perfect Bootstrap rendering).

4. No Licensing Traps

IronPDF licensing:

  • Commercial-first (no AGPL bait-and-switch)
  • Clear pricing upfront ($749 per developer)
  • Perpetual licenses (no forced annual renewals)
  • No runtime fees (unlimited deployments)

iText 7 licensing:

  • AGPL (forces open-sourcing or commercial licensing)
  • Expensive commercial licenses ($1,800+/year)
  • Runtime fees for some deployment scenarios
  • Complex licensing terms (audit risk)

Migration: iTextSharp 5.x to IronPDF

Pattern 1: Create PDF from HTML

Before (iTextSharp 5.x):

using iTextSharp.text;
using iTextSharp.text.pdf;
using iTextSharp.tool.xml;
// Install via NuGet: Install-Package iTextSharp (abandoned)

var html = "<h1>Invoice #12345</h1><p>Total: $500</p>";
var htmlStream = new MemoryStream(System.Text.Encoding.UTF8.GetBytes(html));

using var pdfStream = new FileStream("invoice.pdf", FileMode.Create);
var document = new Document();
var writer = PdfWriter.GetInstance(document, pdfStream);
document.Open();

XMLWorkerHelper.GetInstance().ParseXHtml(writer, document, htmlStream, null);
document.Close();
Enter fullscreen mode Exit fullscreen mode

After (IronPDF):

using IronPdf;
// Install via NuGet: Install-Package IronPdf

var html = "<h1>Invoice #12345</h1><p>Total: $500</p>";

var renderer = new ChromePdfRenderer();
var pdf = renderer.RenderHtmlAsPdf(html);
pdf.SaveAs("invoice.pdf");
Enter fullscreen mode Exit fullscreen mode

Benefits:

  • 70% less code
  • No stream management
  • Modern HTML/CSS support
  • Clearer intent

Pattern 2: Merge Multiple PDFs

Before (iTextSharp 5.x):

using iTextSharp.text;
using iTextSharp.text.pdf;
// Install via NuGet: Install-Package iTextSharp (abandoned)

using var outputStream = new FileStream("merged.pdf", FileMode.Create);
var document = new Document();
var writer = new PdfCopy(document, outputStream);
document.Open();

foreach (var file in new[] { "doc1.pdf", "doc2.pdf", "doc3.pdf" })
{
    var reader = new PdfReader(file);
    for (int i = 1; i <= reader.NumberOfPages; i++)
    {
        writer.AddPage(writer.GetImportedPage(reader, i));
    }
    reader.Close();
}

document.Close();
Enter fullscreen mode Exit fullscreen mode

After (IronPDF):

using IronPdf;
// Install via NuGet: Install-Package IronPdf

var pdf1 = PdfDocument.FromFile("doc1.pdf");
var pdf2 = PdfDocument.FromFile("doc2.pdf");
var pdf3 = PdfDocument.FromFile("doc3.pdf");

var merged = PdfDocument.Merge(pdf1, pdf2, pdf3);
merged.SaveAs("merged.pdf");
Enter fullscreen mode Exit fullscreen mode

80% less code, same result.

Pattern 3: Extract Text from PDF

Before (iTextSharp 5.x):

using iTextSharp.text.pdf;
using iTextSharp.text.pdf.parser;
// Install via NuGet: Install-Package iTextSharp (abandoned)

var reader = new PdfReader("input.pdf");
var text = "";

for (int i = 1; i <= reader.NumberOfPages; i++)
{
    text += PdfTextExtractor.GetTextFromPage(reader, i);
}

reader.Close();
Console.WriteLine(text);
Enter fullscreen mode Exit fullscreen mode

After (IronPDF):

using IronPdf;
// Install via NuGet: Install-Package IronPdf

var pdf = PdfDocument.FromFile("input.pdf");
var text = pdf.ExtractAllText();

Console.WriteLine(text);
Enter fullscreen mode Exit fullscreen mode

One line instead of a loop.

Pattern 4: Fill PDF Forms

Before (iTextSharp 5.x):

using iTextSharp.text.pdf;
// Install via NuGet: Install-Package iTextSharp (abandoned)

var reader = new PdfReader("template.pdf");
using var outputStream = new FileStream("filled.pdf", FileMode.Create);
var stamper = new PdfStamper(reader, outputStream);

var form = stamper.AcroFields;
form.SetField("name", "John Doe");
form.SetField("email", "john@example.com");

stamper.FormFlattening = true;
stamper.Close();
reader.Close();
Enter fullscreen mode Exit fullscreen mode

After (IronPDF):

using IronPdf;
// Install via NuGet: Install-Package IronPdf

var pdf = PdfDocument.FromFile("template.pdf");

pdf.Form.SetFieldValue("name", "John Doe");
pdf.Form.SetFieldValue("email", "john@example.com");

pdf.SaveAs("filled.pdf");
Enter fullscreen mode Exit fullscreen mode

No PdfStamper, no form flattening boilerplate.

Pattern 5: Add Watermark

Before (iTextSharp 5.x):

using iTextSharp.text;
using iTextSharp.text.pdf;
// Install via NuGet: Install-Package iTextSharp (abandoned)

var reader = new PdfReader("input.pdf");
using var outputStream = new FileStream("watermarked.pdf", FileMode.Create);
var stamper = new PdfStamper(reader, outputStream);

var font = BaseFont.CreateFont(BaseFont.HELVETICA, BaseFont.WINANSI, false);

for (int i = 1; i <= reader.NumberOfPages; i++)
{
    var content = stamper.GetOverContent(i);
    content.SetFontAndSize(font, 60);
    content.SetRGBColorFill(200, 200, 200);
    content.BeginText();
    content.ShowTextAligned(Element.ALIGN_CENTER, "DRAFT", 300, 400, 45);
    content.EndText();
}

stamper.Close();
reader.Close();
Enter fullscreen mode Exit fullscreen mode

After (IronPDF):

using IronPdf;
// Install via NuGet: Install-Package IronPdf

var pdf = PdfDocument.FromFile("input.pdf");

pdf.ApplyWatermark("<h1 style='color: rgba(0,0,0,0.2); transform: rotate(-45deg);'>DRAFT</h1>");

pdf.SaveAs("watermarked.pdf");
Enter fullscreen mode Exit fullscreen mode

90% less code, HTML-based watermarks (easier to style).

When to Stay with iTextSharp 5.x

Don't migrate if:

  1. Your application is in maintenance mode with no active development
  2. You're not subject to compliance audits (no PCI-DSS, SOC 2, HIPAA)
  3. You're running .NET Framework 4.x with no plans to upgrade
  4. You only use basic PDF features (text extraction, merging) and never hit bugs

Migrate to IronPDF if:

  1. You need modern .NET support (.NET Core, .NET 5+, Linux, Docker)
  2. You're subject to security audits (iTextSharp 5.x has unfixed CVEs)
  3. You generate PDFs from HTML (iTextSharp's HTML support is terrible)
  4. You want commercial support (iTextSharp 5.x has none)
  5. You're planning to upgrade to iText 7 (IronPDF is cheaper and easier to migrate to)

Security Compliance Checklist

If you're using iTextSharp 5.x in regulated industries, you may already be non-compliant:

PCI-DSS (Payment Card Industry):

  • ❌ Requirement 6.2: Install security patches within 30 days
  • ❌ iTextSharp 5.x CVE-2020-15522 unfixed since 2020

SOC 2 (Service Organization Control):

  • ❌ CC7.1: System components are updated to prevent security vulnerabilities
  • ❌ iTextSharp 5.x abandoned since 2016

HIPAA (Health Insurance Portability):

  • ❌ §164.308: Implement procedures to review records of information system activity
  • ❌ iTextSharp 5.x no longer receives security reviews

ISO 27001 (Information Security):

  • ❌ A.12.6.1: Management of technical vulnerabilities
  • ❌ iTextSharp 5.x vulnerabilities not patched

If your auditor finds iTextSharp 5.x in production, expect findings.

The Bottom Line

iTextSharp 5.x is abandoned software:

  • No updates since 2016
  • Known security vulnerabilities unfixed
  • No .NET Core/.NET 5+ support
  • No commercial support available

Upgrading to iText 7 is expensive and complex:

  • Complete API rewrite (no backward compatibility)
  • AGPL licensing trap (forces open-sourcing or $1,800+/year commercial licensing)
  • Still poor HTML rendering (no flexbox, grid, modern CSS)

Upgrading to IronPDF is cheaper and easier:

  • Modern .NET support (.NET Core, .NET 5, .NET 6, .NET 8, .NET 10)
  • Simple API (3 lines for HTML to PDF)
  • Full HTML5/CSS3 support (Chromium rendering)
  • Clear commercial licensing ($749 per developer, perpetual)
  • 86% cheaper than iText 7 over 3 years

If you're using iTextSharp 5.x in 2025, you're running 9-year-old software with known security holes.

Migrate to IronPDF.

Written by Jacob Mellor, CTO at Iron Software. Jacob created IronPDF and leads a team of 50+ engineers building .NET document processing libraries.

Top comments (0)