How to merge and split PDF files in the browser

Stitching PDFs together, and pulling pages out

The two most common operations on PDFs are combining several files into one and cutting a single file down to a specific range of pages. Expense reports want scanned receipts merged into a single attachment. Contract submissions ask for the main agreement plus exhibits, terms of service, and a power of attorney all in one PDF. On the split side the use cases flip: pull out the pages relating to one client from a 300-page invoice, drop the confidential pages from a deck before sharing it externally, or chop a manual into per-chapter files so different reviewers can work in parallel.

The trap is that “just throw it into Acrobat or any web service” often means uploading contracts, invoices, or payroll PDFs to someone else’s server. The files are not particularly large so it feels harmless, but the sensitivity of the content is usually higher than for a generic compress job — you are literally restructuring the whole document. That is exactly the scenario where staying inside the browser is worth the slightly different workflow.

Doing both in the browser

For merging, open pdf-merge and drop several PDFs onto the page at once. Each file appears as a card you can drag to reorder, and clicking “Merge” produces a single PDF in the order shown. The output name is generated automatically but editable at download time. The multi-file drop plus reordering is the core feature — you can lay out a sequence like “main contract → exhibit A → exhibit B → terms” entirely visually.

For splitting, open pdf-split and load a single PDF. Three modes are offered: explicit page ranges (a comma-separated expression like 1-5, 8, 12-15), even chunks of every N pages, and full expansion to one PDF per page. The range syntax is the human-readable form you would write on paper: 1-5 means pages 1 through 5, 8 means just page 8, 12-15 means pages 12 through 15, and you can mix them in a single expression. Each resulting part can be downloaded individually or grabbed together as a ZIP.

If you keep the DevTools Network tab open while merging or splitting, you will not see any HTTP request tied to the file content — only the initial script fetches. If size becomes a concern after the operation, you can route the output through pdf-compress.

What pdf-lib actually does to the bytes

The engine behind both tools is pdf-lib, specifically PDFDocument.load() plus copyPages(). A fresh PDFDocument.create() document is built up by copying page object references straight from the source PDFs. The crucial part is what this does not do: no rasterising, no re-encoding. Embedded fonts, vector shapes, image streams, hyperlinks, and bookmarks all move into the new document in their original form. Sizes therefore add up almost linearly when merging (and split roughly evenly when splitting), but in exchange you get zero text-edge bleed and zero loss of vector precision.

PDFs with the encryption flag set can be opened with PDFDocument.load(bytes, { ignoreEncryption: true }) to read the metadata, but without the decryption key the content streams come out as blank pages. Both pdf-merge and pdf-split detect this at load time and surface a direct link to pdf-unlock in their error UI — the correct workflow is to remove the password first and then come back. Author, title, and creation-date metadata are preserved into the new file, so if you need to scrub the original author from a redistribution copy, run the result through pdf-meta-strip afterwards.

The structural gap versus upload-style merge sites

Searching for “PDF merge” or “PDF split” surfaces a sea of services that look like this tool but ship the file to their backend for processing. The UI is nearly indistinguishable, but when the input is a contract, an invoice, a medical report, or an internal deck, the act of putting it on someone else’s server is itself a data-flow change. Most of those services include a clause in their terms of use along the lines of “you grant us a non-exclusive license for the purpose of processing”; even if they honour a deletion request later, CDN caches, server logs, and backup snapshots that already touched the file are outside what you can audit.

In-browser merging and splitting has no upload code path to begin with. Both tools rest on pdf-lib, the File API, and Blob URLs, and the source is open for inspection on GitHub. Confirming with your own DevTools that no request fires for the file content is a categorically different guarantee than reading a privacy policy and trusting it. For workflows that touch sensitive PDFs daily, the cost of that guarantee per operation is small enough to make it a default habit.