Deterministic PDF normalization and canonical hashing API

A production-ready API for turning inconsistent PDF files into stable, comparable outputs. PDFCanon removes risky active content, rebuilds structure, and returns hashes your system can trust.

Open pdfcanon.com Read the API docs

POST /v1/normalize

# Request
POST https://api.pdfcanon.com/v1/normalize
Authorization: Bearer pk_live_••••••••••
Content-Type: multipart/form-data
file: @contract-v3.pdf

# 200 OK
{
  "id": "nrm_01j8x7k4m2",
  "status": "success",
  "original_sha256": "a3f4b7c2e91d...",
  "normalized_sha256": "e8c1d2907b4f...",
  "report": { ... }
}

Two saves of one contract

# contract-v3.pdf
original_sha256    "a3f4b7c2e91d..."
normalized_sha256  "e8c1d2907b4f..."

# contract-v3 (resaved).pdf
original_sha256    "7b0e46d1a8c3..."
normalized_sha256  "e8c1d2907b4f..."

The same page, saved twice, is two different files. Normalization makes it one.

PDFs are structurally chaotic

Two visually identical PDFs can produce different SHA-256 hashes because their internal structure, metadata, and save history differ. That makes ordinary file hashing unreliable for deduplication, tamper checks, archival verification, and audit evidence.

Failure mode	Handling
Embedded JavaScript and active content	Stripped during normalization. No JavaScript, no embedded files, no rich media.
Incremental update history	Collapsed. The XRef table is rebuilt and the object graph is re-serialized in a canonical order.
Hidden metadata and object ordering differences	Canonicalized, so differences between PDF producers stop changing the hash.

The result is a stable SHA-256 value your application can compare and store, produced by a normalization step that is idempotent by construction.

What the pipeline guarantees

The core pieces needed to make PDF integrity checks repeatable.

Active content removal

JavaScript, embedded files, rich media, and AcroForms are stripped or flattened during normalization.

Structural canonicalization

Object ordering, XRef rebuilds, incremental update collapse, and metadata stripping reduce producer-specific differences.

Stable SHA-256 hashing

Returns both original and normalized SHA-256 values so your system can compare source files and canonical outputs separately.

Compliance-ready reports

A machine-readable JSON report documents what was detected and changed during normalization.

Multi-tenant API

Organization isolation, API key management, webhook support, and billing support for production SaaS usage.

Usage-based pricing

Pay per normalization with a free tier, so teams can test the API before committing production volume.

Who runs PDFs through it

PDFCanon is built for teams that accept, store, compare, or audit PDFs from outside their own systems.

Segment	What they need from it
SaaS platforms	Accepting PDF uploads from untrusted sources
E-sign companies	Verifying document integrity before and after signing
Fintech & HR SaaS	Onboarding pipelines with document deduplication
Legal tech	Tamper detection and chain-of-custody requirements
Government contractors	Document submission audit trail requirements
Compliance-driven teams	SOC 2, ISO 27001, and regulatory audit evidence

What it runs on, and what it hands back

Implementation details for technical evaluators.

Stack

Component	Detail
Cloud backend	High-throughput normalization with minimal latency, packaged as a stateless API.
PDF toolchain	qpdf, for industry-standard PDF structural transformation.
Tenant isolation	Schema-level partitioning, so one organization's data never shares a namespace with another's.
Storage	Cloud object storage for normalized outputs and their reports.

Normalization report

200 OK - report

{
  "report": {
    "active_content_removed": {
      "javascript": [ ... ],
      "embedded_files": [ ... ],
      "acroforms": [ ... ]
    },
    "structure_canonicalized": {
      "object_order": "canonical",
      "xref": "rebuilt",
      "incremental_updates": "collapsed"
    },
    "metadata_stripped": true
  }
}

One report per normalization, safe to store as audit evidence.

Test it against your own files

Start at pdfcanon.com, review the current free tier, and test the API against the PDF workflows your product already handles.

Open pdfcanon.com Read the API docs