DEV Community

Cover image for Stop sending user PDFs to random cloud APIs (how to do it locally) published
RB
RB

Posted on

Stop sending user PDFs to random cloud APIs (how to do it locally) published

#webdev #privacy #react #javascript

I recently had to build a feature where users could merge a bunch of invoices and scan them for specific keywords.

My first instinct was to do what I always do: grab an API key from Adobe or some generic PDF service, send the file to their server, wait 4 seconds, and get the merged file back.

But looking at the actual data—these were medical bills and tax documents—I realized how insane that workflow is. Why are we conditioning users to upload highly sensitive documents to random AWS buckets just to stitch two pages together? It’s a massive privacy risk, and honestly, the API latency is annoying.

I spent the weekend ripping out the backend API and forcing everything to run client-side. Here is what I learned.

You don't need a backend for PDF manipulation anymore
If you haven't checked out pdf-lib recently, you should. It compiles down to WebAssembly, which means your browser can chew through binary PDF manipulation just as fast as a Node backend.

I threw together a simple utility function. No Express server, no AWS S3 buckets, no waiting for a network request to finish.

import { PDFDocument } from 'pdf-lib';

// Runs entirely in the browser
async function mergeLocally(file1, file2) {
  const pdf1 = await PDFDocument.load(await file1.arrayBuffer());
  const pdf2 = await PDFDocument.load(await file2.arrayBuffer());

  const merged = await PDFDocument.create();

  // Copy and append pages
  const p1 = await merged.copyPages(pdf1, pdf1.getPageIndices());
  const p2 = await merged.copyPages(pdf2, pdf2.getPageIndices());

  p1.forEach(page => merged.addPage(page));
  p2.forEach(page => merged.addPage(page));

  // spit out a blob for the user to download
  const bytes = await merged.save();
  return new Blob([bytes], { type: 'application/pdf' });
}
Enter fullscreen mode Exit fullscreen mode

That’s literally it.

I got a bit obsessed with the "Zero Upload" architecture. Once I realized how snappy it felt to bypass the network tab entirely, I ended up building an entire UI around it.

I put it live at PDF Pro AI just to see how far I could push browser-based processing. I even got a Contract Analyzer working that extracts text locally via WASM before doing any AI checks, so the physical PDF never touches my database.

If you're building SaaS products that handle NDAs, tax forms, or medical records, give client-side parsing a shot. It completely eliminates your server costs for file processing, and more importantly, you don't have to worry about accidentally leaking your users' files.

Has anyone else completely ditched backend PDF rendering, or is there a use-case I'm missing where server-side is still strictly better?

Top comments (0)