PDF Merge (Server-Side)
Merge up to 20 PDFs into a single document on our EU servers using qpdf. Files auto-deleted after 15 minutes. Handles large or password-cleared inputs the in-browser merger cannot.
Reviewed by Aygul Dovletova · Last reviewed
How to Merge PDFs on Our Servers
- Drop 2 to 20 PDFs onto the upload zone or click to open the file picker. Total upload is capped at 500 MB; each file at 200 MB. Each accepted PDF shows as a row with the file name, size, and reorder controls.
- Arrange the queue with the Up and Down buttons on each row. The first row becomes page one of the output, the second row continues the sequence, and so on. Use Remove to drop a file from the queue, or click Add more to append further PDFs without losing the order you already set.
- Click "Merge PDFs". The files upload over HTTPS to our EU server, the canonical native qpdf binary concatenates them into a single PDF, and a signed download URL is returned to your browser.
- Click Download to save the combined file as
merged.pdf. The link is HMAC-signed and stops working after 15 minutes, by which time the originals and the merged output have been removed from disk.
Why Run a Merge on the Server
The in-browser PDF Merger uses pdf-lib compiled to JavaScript and never sends your files anywhere; it is the right tool for small, casual merges where the only thing that matters is that no upload happens. The trade-off is real. Pdf-lib decodes every input fully into memory, allocates a fresh object pool for the output, and serializes the whole thing back through a single pass. On Safari that pattern exhausts the tab's heap somewhere above 500 MB of combined input and the page crashes with a RangeError. Firefox tolerates a little more, Chromium a little more again, but none of them match the headroom available to a native binary running on a server. This server-side tool sidesteps all of that.
The other reason to reach for the backend is encryption. Pdf-lib refuses to load any PDF with a non-trivial encryption dictionary, because content streams are opaque without the decryption key. The browser tool exposes no place to enter a per-file password, which means encrypted inputs cannot participate in a merge there at all. qpdf has the same constraint, but on the server it is paired with the PDF Unlock tool: decrypt first, then merge the plaintext copies here. The two steps stay separate by design - we never want a merger to silently prompt for passwords mid-operation.
What qpdf Actually Does Under the Hood
A PDF is a database of numbered objects, plus a cross-reference table at the end that records the byte offset of every object, plus a trailer that points at the root. Merging two PDFs is a graph-copy operation: take the subgraph rooted at each source document's page tree and splice it under a new parent, then rebuild the cross-reference table so the consolidated object numbers line up. qpdf does exactly this and a little more. It deduplicates identical font and image XObjects across documents when their object hashes match (so a merge of N similar invoices ships one copy of the Helvetica program rather than N). It re-serializes the combined object pool with a fresh XRef stream rather than the legacy plain-text XRef table, which keeps the output compact. And it rebuilds the document catalog with a fresh page tree so every page in the output is a sibling at the top level, not nested inside an outline or article structure inherited from a source.
The trailer of the first input file is the metadata authority for the output. Title, Author, Subject, Producer, Keywords, custom metadata keys, and the document-level /Info dictionary are pulled from input one and propagated. If you need different metadata on the merged file, set it on input one before the merge, or post-process with qpdf --replace-input --metadata-edit after downloading. The page-level /MediaBox, /CropBox, and rotation flags are preserved per page, so you can safely combine A4 and Letter sources into one mixed-size document without normalizing them first.
Concrete Workflows This Page Targets
- Assembling a loan application packet (W-2, 1099, bank statements, tax returns, two years of pay stubs) into a single PDF the underwriter can scroll through without switching tabs.
- Combining a signed master service agreement, a statement of work, and an order form into one artifact for a SOC 2 evidence binder where auditors expect one file per control.
- Merging quarterly board minutes from Q1 through Q4 into one annual archive PDF for governance review.
- Packaging a main contract with exhibits A through G before sending to DocuSign, so the signer accepts one envelope instead of eight.
- Producing a monthly expense report by merging dozens of scanned receipts into a single PDF the accounting team can ingest into their workflow tool.
- Stitching a front cover, a technical datasheet, and a back cover into one marketing PDF that the website can serve as a single download link.
- Combining a slide deck exported from Keynote, a CSV chart exported from Numbers, and a Q-and-A appendix exported from Pages into one all-hands recap PDF.
Pitfalls and Edge Cases
The merge preserves raw page content perfectly but cannot reconstruct higher-level structure that never had a stable cross-document identity. Bookmarks (the outline tree) are not stitched across inputs - if the sources had a table of contents, the output will have none, and you will need to rebuild it in Acrobat or pdfcpu. Cross-document hyperlinks that referenced a page inside another source file dangle because their targets no longer share the same object graph. AcroForm fields with identical names across inputs collide and the first occurrence wins. Inputs that use JavaScript actions (auto-fill on open, validators) keep the script but the actions can fire at unexpected page indexes after the merge - test before sending. Already-encrypted inputs simply fail with a clear error; the merge is atomic, so other files are not partially copied. Mixed PDF/A versions can flip the output out of PDF/A compliance because the conformance level is recorded at the document level, not per page.
How This Compares to CLI Alternatives
For a one-off web merge, this page is faster than installing anything. For a hundred-file batch or anything that must preserve bookmarks, a CLI wins. pdftk one.pdf two.pdf cat output merged.pdf remains the simplest invocation if you already run pdftk - though pdftk is unmaintained and chokes on PDF 2.0. qpdf --empty --pages one.pdf two.pdf -- merged.pdf gives the same result as this tool and is what runs under the hood. mutool merge -o merged.pdf one.pdf two.pdf from MuPDF is the fastest of the three on large pages because it writes a compressed object stream by default. Adobe Acrobat Pro remains the only option that reliably rebuilds a combined table of contents from source bookmarks, which matters if the output is a compliance submission. For everything else, the server-side merger here gets the job done in seconds with no install.
Frequently Asked Questions
How is this different from the in-browser PDF Merger?
The in-browser PDF Merger uses pdf-lib compiled to JavaScript and runs entirely inside your tab. It is fast on small documents but exhausts heap memory on Safari and Firefox when total input crosses a few hundred megabytes, refuses to load encrypted PDFs at all, and produces a fresh object pool that drops the original document outline. The server-side merge here streams every file to our EU server, runs the canonical qpdf binary which has none of those memory limits, and produces a leaner output stream because qpdf can re-emit shared resources only once across the combined document. Both tools accept the same inputs; pick this one when the in-browser tool fails or when the inputs are too large for your tab.
What is the maximum file count and total upload size?
You can submit between 2 and 20 PDFs per merge, with a combined upload ceiling of 500 MB. The per-file size limit is the same 200 MB cap that applies to every backend PDF tool. Twenty files at 25 MB each is a typical heavy-merge scenario the tool handles comfortably; the upload time scales linearly with total bytes and the merge itself is usually done within a few seconds of the last byte arriving.
Does the merge preserve bookmarks, outlines, and metadata?
qpdf retains the document-level metadata of the first input file (Title, Author, Producer, custom keys) and propagates pages exactly as they exist in each source. Outlines are by default not stitched together across documents because the underlying outline graphs reference object numbers that the merge renumbers; if you need a continuous table of contents, use a desktop tool like Acrobat or pdfcpu's bookmark export to rebuild it from the merged file. Form fields with unique names carry through intact; identical-name collisions resolve to the first occurrence.
Can I merge password-protected PDFs?
Not directly. qpdf refuses to copy pages out of an encrypted document without the credential, and this UI does not collect per-file passwords to keep the form simple. Run each encrypted input through the PDF Unlock tool first with its password, then drop the cleared copies into the merger. Combining unlocked PDFs and plaintext PDFs in the same merge is supported.
How is the order of the output determined?
Strictly the order of the file list on the left side of the tool. The top row becomes pages 1 through N of the output (where N is its page count), the second row continues from N+1, and so on. Use the Up and Down buttons on each row to reorder before clicking Merge. Once the merge starts the order is frozen for that run.
Where are the files processed and how long are they kept?
On our EU servers in Helsinki, behind HTTPS. Each upload is written to a temporary working directory, qpdf is invoked once to produce the merged output, and the result is exposed at an HMAC-signed download URL that stops working after 15 minutes. Both the originals and the merged output are deleted by a cleanup cron that runs every 5 minutes. We do not log file contents and we do not retain the merged result.
Will the merged PDF be smaller than the sum of its parts?
Usually slightly smaller. qpdf can deduplicate identical font and image XObjects across documents when they share the exact same byte content, which happens often if the inputs were generated by the same exporter (Word, LaTeX, Chrome's print-to-PDF). Inputs that ship unique embedded images per file see no such savings; for those, run the output through the PDF Compressor afterward to downsample images.
What happens if one of the inputs is corrupted?
qpdf reports the offending file and the merge job is marked failed in the queue. The UI surfaces that error inline so you can remove or fix the bad input and retry. The other files are not partially merged - the operation is atomic.
Can I merge the same PDF twice in one output?
Yes. The file list treats each row as an independent entry, even if two entries reference the same underlying file. Drop the same cover sheet twice and it appears at both positions you chose in the queue.
Does the merge re-stream the content or copy raw bytes?
qpdf re-serializes the combined object pool with a fresh cross-reference table. Content streams themselves are copied verbatim (no re-encoding, no quality loss), but the surrounding object numbers, the trailer, and the XRef are rebuilt. The result is a structurally clean PDF that opens consistently across Adobe Acrobat, Apple Preview, Chrome, Firefox, and pdftotext.
More PDF Tools
Image to PDF
Combine multiple JPG and PNG images into a single PDF document.
Open toolPDF Compressor
Compress PDFs with Ghostscript image downsampling. Pick a quality preset. Files auto-deleted after 15 minutes.
Open toolPDF Merger
Merge multiple PDF files into a single document with drag-and-drop reordering.
Open toolPDF Page Reorder
Rearrange pages in a PDF document with a visual drag-and-drop interface.
Open toolPDF Password Protect
Add AES-256 password protection to PDF files via qpdf. Files auto-deleted after 15 minutes.
Open toolPDF Rotate (Server-Side)
Rotate every page of a PDF, or just a selected range, by 90, 180, or 270 degrees on our EU servers. qpdf-based, metadata preserved. Auto-deleted after 15 minutes.
Open tool