A native, local-first PDF workspace for macOS — including AcroForm and LiveCycle/XFA forms.

Imprimatur opens the PDFs that matter in everyday work: ordinary documents, interactive AcroForms, and many dynamic Adobe LiveCycle/XFA forms that macOS PDF apps usually cannot display correctly. It combines reading, form filling, markup, page organization, conversion, review, signing, and printing in one native workspace. Document processing stays on the Mac; there is no account, upload service, telemetry, advertising, or cloud dependency.

Note

Imprimatur is under active development. Build it from source today. Signed and notarized public downloads will appear only after the release qualification documented in the project status is complete.

What you can do

Open and fill difficult PDF forms

• Render and interact with standard PDFs, AcroForms, and many dynamic XFA forms.
• Move through fields with the keyboard, jump to the next incomplete field, and work with text boxes, checkboxes, radio buttons, combo boxes, and list fields.
• Edit qualified XFA datasets without flattening the live source form.
• Import or export XFA data as selector-preserving JSON, canonical XML, or spreadsheet-safe CSV.
• Save incrementally so supported form structures and unrelated document data remain intact.

Read and navigate

• Browse continuous, single-page, facing-page, and cover-facing layouts.
• Use thumbnails, outlines, bookmarks, attachments, page entry, and local text search.
• Switch between original, night, sepia, reflow, and read-aloud-oriented views.
• Open recent documents using the native macOS recent-document list.
• Work in compact windows without losing the document canvas or current task.

Annotate and review

• Add text, notes, freehand drawing, highlights, underlines, strikeouts, squiggles, rectangles, ellipses, lines, arrows, callouts, stamps, and drawn signature marks to ordinary PDFs.
• Select, move, resize, delete, undo, and redo Imprimatur-authored markup.
• Reopen saved annotations with explicit PDF appearance streams.
• Review comments and inspect certificate signatures, later revisions, signer metadata, and the result of offline macOS trust evaluation.
• Respect document certification policy instead of offering a permission bypass.

Organize pages without sacrificing the source

Preview rotations, crops, reorderings, inserts, duplicates, deletions, extracts, splits, and mixed PDF/image merges before publishing anything. Page operations are undoable and write a new derivative rather than mutating the open source. The result report describes what happens to outlines, destinations, links, annotations, widgets, page labels, metadata, signatures, and certification.

Convert locally, with explicit loss reporting

Imprimatur creates separate outputs through private staging, collision refusal, validation, and atomic publication:

• static PDFs, including visually faithful raster derivatives of dynamic XFA;
• PNG, JPEG, and single-frame TIFF page images;
• page-delimited UTF-8 text;
• PDFs assembled from ordered images;
• page packages produced by extract, split, insert, and merge;
• XFA datasets in JSON, XML, and CSV; and
• editable AcroForm derivatives when discovered XFA controls have stable page geometry and supported value semantics.

Dynamic, scripted, repeated, or unresolved XFA controls are not silently dropped into a misleading editable form. Imprimatur explains the expected losses and refuses that conversion while leaving static-PDF and data interchange available.

Save, export, print, and sign deliberately

Action	Result
Save	Atomically updates the open file from private staging.
Save As…	Creates a selected copy and makes it the working document.
Export Flattened Copy…	Creates a separate non-editable derivative with signature-loss acknowledgement when needed.
Print…	Prints a private committed snapshot through the native macOS print panel without changing the open document.
Drawn signature	Adds visible handwriting as an ordinary annotation; it does not claim cryptographic identity.
Certificate signature	Creates an incremental PAdES-B-B revision with an RSA identity from macOS Keychain or a connected OpenSC PKCS#11 token.

Dynamic XFA printing and flattened export preserve visible appearance through a bounded raster path. The resulting text is no longer searchable; the UI says so before publishing the derivative.

Built for local and sensitive work

Imprimatur is designed for government, legal, administrative, and archival PDFs that should not be uploaded merely to fill, inspect, or convert them.

• PDF bytes, form values, searches, annotations, and print snapshots stay local.
• Live PDFium/V8/XFA work runs in a supervised per-document helper with network, child-process, Mach-service, and ambient filesystem restrictions.
• The helper uses private workspaces, request deadlines, kernel limits, and a resident-memory watchdog.
• Keychain private keys remain behind Security.framework; CAC/PIV operations are delegated to the selected PKCS#11 token.
• Certificate trust inspection disables network fetching and reports only the offline trust information actually available.
• Diagnostics omit form values, annotation paths, PINs, private keys, and certificate secrets.

See the security policy, release security posture, and supported limits for details.

Local automation and advanced tooling

The openpdf CLI and Document → Automation… expose bounded local workflows for document structure, security and sanitization, form authoring, OCR, document creation, export, production, content editing, comparison, accessibility, and preflight. Automation uses typed manifests, immutable input snapshots, dry runs, queue and resource limits, cancellation, and no-clobber publication. Optional tools are detected locally; unavailable capabilities are refused rather than replaced with a remote service.

Signing and secret-bearing actions are intentionally excluded from the batch registry. They remain explicit interactive or dedicated CLI workflows.

Install and run

Requirements

• Apple-silicon Mac
• macOS 13 or later
• Rust toolchain for source builds

Build from source

git clone https://github.com/8tp/imprimatur.git
cd imprimatur
scripts/fetch-pdfium.sh
cargo run --features gui --bin imprimatur

Open a document directly:

cargo run --features gui --bin imprimatur -- /path/to/document.pdf

Fetch the checksum-pinned public fixtures before running the complete corpus:

scripts/fetch-samples.sh
cargo test --locked --all-targets --all-features

For local app-bundle packaging and the complete QA/release workflow, see the development guide. Local ad-hoc archives are clearly marked LOCAL-UNNOTARIZED and are not release downloads.

Command-line examples

openpdf inspect <file.pdf>
openpdf fill <in.pdf> <out.pdf> --assignments-stdin
openpdf render <file.pdf> <page-index> <out.png>
openpdf signatures <file.pdf>
openpdf keychain-identities
openpdf pkcs11-identities <module>
openpdf automate <manifest.json> <inputs.json>

Use standard input or a mode-0600 assignment file for sensitive form values; command-line arguments can be exposed through process listings and shell history.

Project documentation

• Documentation index
• User guide
• Supported systems and limits
• Development and release guide
• Architecture
• Current implementation and release qualification
• Contributing
• Security policy

Contributing

Issues, focused pull requests, fixture reports, accessibility feedback, and viewer-interoperability results are welcome. Start with CONTRIBUTING.md. Please do not attach private forms, personal data, certificates, keys, or token logs to an issue.

License

Imprimatur is available under either the MIT license or the Apache License 2.0, at your option.

Imprimatur is not affiliated with Adobe or any government agency. Adobe Acrobat, Adobe LiveCycle, and related names are trademarks of Adobe Inc.; they are used only to describe document formats and interoperability.