Documents, assembled — without a server in the loop.

What it's for

Day-to-day work generates a constant trickle of paper — signed forms, inspection photos, receipts, permits — that eventually needs to become one clean PDF. That usually means a phone scanning app, some manual reordering, and often a third-party service somewhere in between. Collate removes that middle step: pictures of documents go in, an organized file comes out, and nothing is ever transmitted anywhere along the way.

How the “no upload” part actually works

Everything — reading the images, rendering PDF pages, building the merged file — happens inside the browser tab itself, using the same JavaScript engine that renders this page. There's no server component receiving files, no API endpoint accepting uploads, and no database storing anything. Close the tab, and nothing of what you processed persists anywhere except the file your browser already saved to your device.

That much is true of the architecture. But architecture is a promise, so the app also ships a Content Security Policy that makes the browser enforce it. The policy restricts outbound connections to this app's own origin, which has no endpoint capable of receiving a document. Even if a malicious PDF or a compromised dependency tried to send your files somewhere, the browser would block the request before it left the machine.

File compatibility

Technical disclosures

Things worth knowing before trusting this with something that matters.

Under the hood

Collate is a Next.js app with no API routes, no server actions, and no environment variables — there is nothing for a server to do, and no credentials or secrets exist in this codebase to expose. The excerpt below is real, trimmed only for length:

// lib/pdfEngine.ts — trimmed for readability
export async function buildOutputPdf(items, sourceDocs, options) {
  const out = await PDFDocument.create();

  for (const item of usable) {
    if (item.kind === "image") {
      // Image bytes are read straight from the File object already
      // sitting in browser memory — decoded, rotated and re-encoded in
      // a Web Worker, then embedded. No network call at any point.
      const jpegBytes = await encodeImage(item.file, item.rotation, ...);
      out.addPage(...).drawImage(await out.embedJpg(jpegBytes), ...);
      continue;
    }

    // A page whose content lives in widget annotations — a signature
    // block, a filled form field — can't be copied natively: pdf-lib
    // doesn't carry the AcroForm across, so that content would vanish
    // without any error. Those pages get rendered instead.
    const flatten =
      options.forceFlatten ||
      source.isEncrypted ||          // pdf-lib cannot decrypt, ever
      source.hasSignature ||
      source.widgetPages?.includes(item.pageIndex);

    if (!flatten) {
      // Native copy — text and vector content stay intact, and page
      // rotation is metadata rather than pixels, so it stays lossless.
      const [copied] = await out.copyPages(sourceDoc, [item.pageIndex]);
      out.addPage(copied);
    } else {
      // Rendered with intent:"print" so annotation appearances are drawn
      // into the page, the same way "Print to PDF" behaves.
      const raster = await rasterizePdfPageForEmbed(source, item.pageIndex, ...);
      out.addPage([raster.widthPt, raster.heightPt]).drawImage(...);
    }
  }

  return out.save(); // bytes held in memory — handed straight to a download
}

Everything else follows the same pattern — pdf-lib assembles and merges PDFs, pdf.js renders thumbnails and rasterizes pages for image export, heic2any decodes iPhone photos, and jszip bundles multi-page image exports. All of it runs as ordinary JavaScript in this tab, with no network calls to anywhere but the host that served the page itself.

Dependencies are kept current for security reasons rather than novelty: the PDF rendering library in particular has a history of vulnerabilities that let a crafted PDF run code in the page, which for a tool like this would undermine the entire point. Collate runs a patched version and additionally disables the language feature those attacks relied on.