BASALT · JOURNAL
Offline PDF editors for Mac that work with the network switched off
When people look for an offline PDF editor Mac users can rely on, they mean one of two different things: an app that keeps working on a plane, or an app that cannot send their documents anywhere even if it wanted to. Those are very different technical requirements, and only the second can be proven rather than promised.
Why offline is a requirement, not a preference
For most documents, convenience is the only thing at stake. For others, the transfer itself is the problem.
Uploading a file to a processing service is a disclosure to a third party, and it happens before the service does anything with the document. If the file contains privileged material, personal data under GDPR, protected health information, or anything under a protective order, the upload is the event you would have to account for. The privacy policy governs what happens next; it does not undo the transfer. The risk in cloud PDF tools covers this.
There are also environments where the network is not available: secure facilities, air-gapped review machines, field work.
Four levels of offline, from weakest to strongest
Level one: it runs without an internet connection. Most desktop applications qualify, and this says nothing about what happens when a connection is available.
Level two: it does not upload documents. Better, but this is a claim in a privacy policy rather than a property of the software. The app may still check for updates, validate a license, or send analytics, each of which means it has network code.
Level three: it has no network capability at all. The component that parses your documents cannot open a socket. Not configured not to; unable to.
Level four: level three, enforced by the operating system and independently checkable. On macOS this is the App Sandbox and entitlements. A sandboxed process without a network entitlement cannot make outbound connections, and the restriction is applied by the kernel from the code signature, not by the app's own logic.
The jump from level two to level four is the whole point: level two asks you to trust a policy, level four lets you check a fact.
How to verify an offline claim yourself
You do not have to take a vendor's word for any of this. Three checks, none requiring special tools.
Read the entitlements. Run codesign -d --entitlements :- /Applications/YourApp.app and look for com.apple.security.app-sandbox and com.apple.security.network.client. Sandbox true with no network client entitlement means the process cannot reach the network. If a vendor separates document parsing into a helper process, check that helper too, since it is the component that touches your file.
Watch the traffic. An outbound firewall such as Little Snitch shows every connection an application attempts, including the ones made quietly at launch. Open a document, run every operation you care about, and see what appears.
Pull the plug. Turn off Wi-Fi and use the app for a full working session. An application designed offline will not notice; one that was not will show you where it depends on a server.
Criteria for an offline PDF editor Mac users can trust
Beyond the network posture, the same properties matter that would matter anyway.
No account, and activation that does not recur. An account is a server dependency and an identity record. A one-time activation at install is reasonable; a periodic check means the software stops working in a secure facility and can be withdrawn.
No telemetry. Usage analytics are a network channel, and often the only one a well-intentioned app has. Ask whether disabling it is enforced or merely requested.
Local processing for everything, including OCR. OCR is the most common place where a "local" app quietly becomes a hosted one, because cloud recognition is easier to build. The same goes for Office conversion.
Originals untouched. Every operation should write a new file, never edit in place.
Verifiable results. Offline is about where the file goes. Correctness is separate and deserves the same standard of proof. How to verify a PDF redaction shows how to check an output file.
The options, honestly
Apple Preview is fully local and free, and nothing you do in it leaves the machine. It views, annotates, reorders, merges, splits, signs, and fills simple forms. Its markup tools paint over content rather than removing it, so it is not a redaction tool.
Adobe Acrobat Pro performs its core editing locally and is also deeply integrated with cloud storage, cloud conversion, and account-based licensing. Which parts touch the network depends on configuration. It is offline-capable rather than offline by design.
Browser services such as Smallpdf and iLovePDF are the opposite of what this page is about. They are convenient, and appropriate only for documents you would email to a stranger.
Native Mac editors in the PDF Expert and PDFpen category edit on the machine. Most also offer cloud sync, cloud OCR, or account features, so the question is which operations stay local. Check the entitlements, not the marketing copy.
Command line tools such as qpdf, mutool, and Ghostscript are entirely local, free, and scriptable, with no interface and no guardrails. That makes them excellent for verification and awkward for daily work.
Basalt was built to level four. The engine that parses documents runs as a separate XPC process with no network entitlement, enforced by macOS at the code-signature level, and there is no account and no telemetry. See PDF tools for Mac in one window.
Offline does not mean private by itself
Keeping a document on your machine controls where it goes; it does not control what is inside it.
A PDF you never uploaded can still carry the author's name in its metadata, the original filename in its XMP packet, an embedded attachment, a switched-off layer, or a prior page version left by an incremental save. Hidden data in PDFs covers each surface. Sanitizing content is a separate problem from keeping processing local.
Frequently asked questions
What is the best offline PDF editor for Mac?
The best choice is an application that processes documents entirely on the machine, requires no account, sends no telemetry, and can be verified rather than trusted. Apple Preview is fully local and free for viewing, annotation, and page operations. For OCR, compression, Bates numbering, and redaction, a native app such as Basalt keeps everything local.
How can I tell if a Mac app is really offline?
Run codesign -d --entitlements :- /Applications/YourApp.app and check whether the app is sandboxed and whether it holds the network client entitlement. A sandboxed process without that entitlement cannot open outbound connections, because macOS enforces the restriction from the code signature rather than the app's own logic.
Does Apple Preview send my PDFs anywhere?
No. Preview processes documents locally and does not upload them, so anything you view or annotate stays on the machine unless the file itself lives in iCloud Drive. That makes it a reasonable choice for confidential viewing and markup. It is still not suitable for redaction, because its markup tools draw over content instead of removing it.
Are online PDF editors safe for confidential documents?
Using one means transferring the document to a third party's infrastructure before any processing happens, so the upload itself is the disclosure. For privileged material, personal data, health records, or anything under a protective order, that transfer is what you would have to account for, whatever the retention policy says.
Can I edit a PDF on a Mac without internet?
Yes. Every core PDF operation, meaning page assembly, annotation, form filling, compression, OCR, passwords, signing, and redaction, is computation that can be done entirely on your machine. Preview covers the basics with no connection, and native applications cover the rest. The only operations requiring a network are ones a vendor chose to host.
Does an offline PDF editor still need a license check?
That depends on the vendor, and it is worth asking before purchase. A single activation at install is compatible with working offline indefinitely afterward, while a recurring check means the application stops working in an air-gapped environment and can be withdrawn. Basalt activates once, then works offline forever.
Is offline the same as private?
No. Offline controls where a document goes, while privacy also depends on what the document contains. A file that never left your machine can still carry author names in its metadata, original filenames in its XMP packet, embedded attachments, hidden layers, and prior page versions left by incremental saves. Both problems need solving.
Does offline OCR work as well as cloud OCR?
For ordinary printed documents, local OCR on modern Macs is accurate enough that the difference rarely matters, and Apple's on-device recognition frameworks are strong. Cloud services can hold an edge on unusual scripts, handwriting, and very poor scans. For confidential material the comparison is moot, since uploading is not an option.
Doing it in Basalt
Basalt runs entirely on your Mac: no account, no telemetry, no cloud, and full function offline forever after a single activation. The engine that parses your documents runs as a separate process with no network entitlement, enforced by macOS at the code-signature level, which you can confirm by running codesign -d --entitlements :- /Applications/Basalt.app/Contents/XPCServices/BasaltEngine.xpc. Eighteen tools live in one window with documents open as tabs, and every tool writes a new file. It is not a page-layout editor, it does not do certificate-based digital signatures, it is Mac only, and it will not open a password-protected file without the password. $29 once for up to three Macs, free for 24 hours, at basaltformac.com.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.