The PDF editor is one of those categories where the default answer has been the same for thirty years, and the default answer rents you the privilege of editing your own document by the month, phones home about it, and still manages to feel like it was designed by a committee that never had to redact a lease at midnight, so the real question behind Kanoprii was never “can we build a PDF editor” but “why is the honest, offline, one-payment-forever version of this tool still not the normal thing you reach for,” and the answer we kept arriving at is that nobody wants to maintain the boring parts, the page model, the annotation layer, the print dialog that respects duplex, the signature flow that verifies, because the boring parts are where PDF editors actually live.
Kanoprii is our answer, a Tauri 2 desktop app with a Rust core and PDFium under it, shipping on Linux, macOS, and Windows as GPL-3.0-only, and it is deliberately the unglamorous kind of product: open a document, rearrange pages, annotate, fill a form, sign it with a real certificate, export to Markdown, close the app, and your file never once left the machine, because there is no account, no cloud, and no telemetry to leave for.
Non-destructive is the whole point
The single decision everything else hangs off is that every edit lands in a working copy, so the original file on disk stays untouched until you explicitly save, and undo and redo run fifty steps deep because a page operation you regret at step forty should cost you a keystroke, not a restore from backup, a model that sounds obvious until you remember how many editors treat “Save” and “Export a mangled copy” as the same button.
On top of that model sits the everyday toolkit, and it goes deeper than the usual split-and-merge: highlights, sticky notes, freehand ink, shapes, stamps, redaction boxes you can burn in with optional OCR restore, in-PDF text blocks and image placement that persist into the file, interactive form filling and creation, Bates numbering, a Make Searchable pass for scans through Tesseract, and PAdES digital signatures from a PKCS#12 certificate with a verification panel, which is the point where most “lightweight” editors quietly wave you toward a subscription and we just kept writing Rust.
The conversion story earned its keep during testing too, since Markdown and HTML open as first-class documents and a PDF can export back out to Markdown, using the tagged structure when the producer bothered to write it and a PDFium layout heuristic with column reading order when it didn’t, with embedded images and rasterized vector charts landing in an assets folder next to the output, which turns “send me that report as text” from a copy-paste afternoon into a menu item.
Why PDFium and not a prettier bet
Rendering runs through pdfium-render against a standard build of PDFium’s C API, the same engine Chromium ships, because correctness on weird files beats elegance every time, and the PDF corpus in the wild is nothing but weird files; twenty years of Word exports, scanner drivers, and banking systems have produced documents that break every pure-Rust renderer we’ve watched come and go, and PDFium has already paid that correctness tax with interest.
The one sharp edge worth publishing is that distro-packaged PDFium, the libdeepin-pdfium family, does not expose the standard C FPDF_* interface the binding expects and is flatly not compatible, so the build fetches a known prebuilt PDFium library and resolves it in a sensible order, PDFIUM_LIB_PATH first, then beside the executable, then the bundled resource path, then the system library, and the fetch script exists precisely so that “works on my machine” stops being a support category.
The rough edges we actually hit
The pitch for Tauri is that you write Rust and a webview and get three platforms, and that part is true, but the platform you actually get on Linux is WebKitGTK sitting on whatever the compositor feels like today, and two of the scars were specific enough that they live in the README as environment variables now, which is where scars belong.
The first was file dialogs, because on Linux Wayland the XDG desktop-portal picker can hang WebKitGTK on some stacks, not crash, hang, which is the worst failure mode for a modal dialog, so open and save default to in-app path entry and a built-in browser on Wayland while macOS, Windows, and X11 keep their native pickers, and KANOPRII_NATIVE_DIALOGS=1 exists for the people whose portal stack is healthy and who want the native dialog back.
The second was the DMABUF renderer, where some multi-GPU Wayland setups die with Gdk Error 71 the moment zero-copy presentation kicks in, so the app sets WEBKIT_DISABLE_DMABUF_RENDERER=1 at startup when you haven’t set it yourself, GPU compositing stays on and only the zero-copy path is disabled, and the user-visible cost is nothing anyone has measured while the crash it prevents was measured in bug reports.
Neither fix is clever, and that is the lesson: cross-desktop Linux in 2026 is mostly knowing which default to flip on which session type, GNOME and KDE and XFCE each behaving just differently enough at the portal and GPU layer that “it worked on the dev’s Sway install” is not a test matrix, and writing the workaround down with an escape hatch beats pretending the abstraction holds.
Size, updates, and what you give up
The installed packages stay small, the .deb, .rpm, and .msi all land around 14 MB and the Windows setup wrapper is smaller still, with the AppImage the fat one at about 84 MB because it carries its own runtime like AppImages do, and updates come through the app’s own signed latest.json check rather than a store, which keeps the whole thing honest about what runs on your machine.
The tradeoffs are the Tauri ones and we’d rather name them: the UI is a webview, so the day you hate WebKitGTK’s font rendering you hate it inside our app too, native file dialogs on Wayland are opt-in until the portal situation settles, and OCR quality is Tesseract’s to keep, which is to say very good on clean scans and humble on phone photos of receipts.
The modern equivalent math here is the same math small tools keep winning with: a PDF editor that opens fast, never asks who you are, signs with a real certificate, and costs nothing to audit is not a nostalgia project, it is what the category looked like before the rent-seeking started, and the only reason it feels unusual in 2026 is that shipping it means doing the boring parts yourself, the working copy, the page model, the Wayland workarounds, the offline license viewer, and doing them is exactly what we built Kanoprii to prove is still possible.