tc-lib-pdf (TCPDF)
The next generation of TCPDF - a modern, modular PHP library for programmatically generating PDF documents.
Keep TCPDF maintained. tc-lib-pdf is the actively-developed successor to TCPDF, which is installed 100M+ times across 500+ PHP packages and is now maintenance-only. If your company depends on it, become a sponsor to keep this shared infrastructure secure and maintained. See Sponsors for tiers.
Contents
Overview
tc-lib-pdf is a pure-PHP library for generating PDF documents.
It is the modern evolution of TCPDF, built around a modular package architecture, a Composer-first workflow, and strict PHP types.
It coordinates companion packages for fonts, images, graphics, pages, filtering, encryption, and digital signatures into a single document-authoring API.
Why tc-lib-pdf:
- Pure PHP. No external binaries, headless browsers, or shell calls in the rendering pipeline. Only
gd and zlib are optional extensions.
- Archival, print, and accessibility conformance in one library. PDF/A (1/2/3, a/b/u), PDF/X (1a, 3, 4, 5), and PDF/UA (1, 2) are built in, under the LGPL.
- Signing up to PAdES B-LTA. Detached CMS and PAdES B-B/B-T/B-LT/B-LTA, with RFC 3161 timestamps, embedded revocation evidence, and support for both local keys and remote HSM signing.
- Reproducible output. Pinning the dates and file identifier renders byte-identical documents on every run, so builds are diffable and verifiable.
- Modular and strictly typed. Each concern is a separate Composer package with declared types, so upgrades and dependencies stay scoped.
- Continuity with TCPDF. The actively-developed successor to a library installed 100M+ times, by the original author.
Releases follow Semantic Versioning:
- PATCH: backwards-compatible bug fixes
- MINOR: backwards-compatible new features
- MAJOR: breaking changes
Sponsors
tc-lib-pdf is the actively-developed successor to TCPDF, which is installed 100M+ times across 500+ PHP packages and is now maintenance-only. Sponsoring funds the ongoing security and maintenance work on both.
Your logo here. Be the first company to back the project: become a sponsor →
See SPONSORS.md for sponsorship tiers, how to add your logo, and the logo/content policy. Individual backers are listed in BACKERS.md.
For TCPDF Users
tc-lib-pdf is not a drop-in replacement for TCPDF:
- The codebase is split across separate Composer packages instead of a single distribution.
- The API is strongly typed and organized around companion services such as fonts, pages, graphics, and images.
- Setup is Composer-first: asset preparation such as font generation is part of project bootstrap, not a bundled step.
The runnable examples in examples/index.md cover the equivalent of most TCPDF workflows.
Features
Text & Fonts
- Full UTF-8 Unicode and right-to-left (RTL) language support
- TrueTypeUnicode, OpenTypeUnicode v1, TrueType, OpenType v1, Type1, and CID-0 fonts
- Supplementary-plane characters above U+FFFF, including mathematical alphanumeric symbols and emoji (doc/FONTS.md)
- Font subsetting to keep file sizes small
- Text hyphenation, stretching, and letter-spacing (tracking)
- Language-aware TeX hyphenation patterns and optional zero-width breakpoints
- Text rendering modes: fill, stroke, and clipping
- Automatic line breaks, page breaks, and justification
Layout & Content
- All standard page sizes, custom formats, custom margins, and configurable units of measure
- HTML and CSS rendering
- SVG rendering
- Multi-column layouts and no-write page regions
- Headers, footers, and common page content
- Bookmarks, named destinations, and table of contents
- Automatic page numbering and page groups
- Full page box control (Media/Crop/Bleed/Trim/Art), page reordering, and viewer preferences
- Per-page transparency group control via
setPageTransparencyGroup(): 'auto' (default) emits the page transparency /Group only on pages that use transparency, 'always' emits it on every page, 'never' omits it
Images & Graphics
- Native JPEG, PNG, and SVG support
- Extended image format handling via GD (
GD, GD2, GD2PART, GIF, JPEG, PNG, BMP, XBM, XPM, WBMP, TIFF, ICO, PSD, IFF, SWC)
- Geometric graphics and 2D transformations
- Linear and radial gradients, Coons patch mesh gradients, crop marks, and registration bars
- JPEG and PNG ICC profiles, grayscale/RGB/CMYK/spot colors, transparencies, and overprint control
Security & Standards
- Password and certificate-based document encryption (RC4 and AES, up to 256-bit)
- Remote resource controls via
fileOptions with host allowlists plus separate internal and markup local-path allowlists for external assets
- Digital signatures: detached CMS (PKCS#7) and PAdES baseline signatures (ETSI EN 319 142-1) through the
signature() facade, with configurable appearance fields. Profiles: legacy (ISO 32000-1 adbe.pkcs7.detached), pades-b-b, pades-b-t, pades-b-lt, pades-b-lta (ETSI.CAdES.detached), with RSA or ECDSA keys and sha256/sha384/sha512 digests. Local (private-key) and external/remote (HSM) signing are both supported. The cryptography lives in tc-lib-pdf-sign; see doc/DIGITAL_SIGNATURES.md
- RFC 3161 TSA timestamps (PAdES B-T): a timestamp token is embedded in the CMS as the
id-aa-signatureTimeStampToken attribute, with configurable digest algorithm, policy OID, nonce, timeout, and TLS peer verification. The token is verified and matched against the request before it is embedded
- LTV (Long-Term Validation) (PAdES B-LT): revocation evidence in a post-signing incremental revision:
- collects the signing certificate chain and fetches OCSP responses and CRL payloads from AIA and CDP URLs
- verifies every response before embedding it, including the certificates carried by the signature timestamp token
- deduplicates binary payloads by fingerprint
- emits a Document Security Store (
/DSS) carrying /VRI, /Certs, /OCSPs, and /CRLs, referenced from the re-emitted document catalog
- OCSP, CRL, cert embedding, DSS, and VRI are each enabled independently through the
signature() LTV options
- Archive timestamps (PAdES B-LTA):
signature()->upgradeToLta() adds a /Type /DocTimeStamp archive timestamp over the whole document in a further incremental revision
- PDF annotations: links, text notes, file attachments, markup, shapes, media, and widgets
- JavaScript embedding
- PDF/A (1/2/3, including a/b/u conformance levels): see doc/STANDARDS.md and E001_invoice.php for a Factur-X / ZUGFeRD example
- PDF/X (generic alias, PDF/X-1a, PDF/X-3, PDF/X-4, PDF/X-5): print-exchange conformance covering per-variant OutputIntent identifiers, GTS_PDFXVersion in Info dict and XMP, PDF version enforcement, CMYK color forcing for restrictive profiles (X-1a, X-3), transparency restrictions, and suppression of encryption and JavaScript
- PDF/UA (generic alias, PDF/UA-1, PDF/UA-2): accessibility conformance covering tagged structure tree (
StructTreeRoot / ParentTree), MarkInfo /Marked true, document language (/Lang), DisplayDocTitle true, ActualText for ligatures and special glyphs, figure alt-text tagging, and heading-level clamping to prevent skipped levels; PDF/UA-2 targets PDF 2.0
PDF Import
- Import pages from existing PDFs as Form XObjects and place them on any destination page
- Import a single page at a user-defined position and scale (
importPage / useImportedPage)
- Append full documents page-by-page, auto-sized to the source page dimensions (
addPageFromImport)
- Load source PDFs from a file path or raw byte string (
setImportSourceFile / setImportSourceData)
- Configurable parser limits with either a warning or an exception when a source cannot be fully resolved (
max_resolution_depth, max_nesting_depth, strict_limits)
Other
- 1D and 2D barcodes via
tc-lib-barcode
- Interactive AcroForm fields (buttons, checkboxes, radio buttons, text, combo boxes, list boxes)
- XObject templates and layers with object visibility controls
- Multiple output targets: inline display, forced download, file save, and MIME attachment
- Factur-X / ZUGFeRD / Order-X workflows via embedded XML in PDF/A-3 documents (
setFacturX())
- Reproducible output: pin the dates and the file identifier (
setDocCreationDate(), setDocModificationDate(), setFileId()) to render the same bytes on every run
- Stream compression via the
zlib PHP extension, available in every conformance mode
Requirements
- PHP 8.2 or later
- Composer
Optional PHP extensions: gd, zlib.
Feature-specific prerequisites:
- Digital signatures, timestamps, and LTV require signing certificates and keys, plus any TSA or revocation endpoint the configuration references.
make preflight runs external validation tools when they are installed.
Installation
- Install the package with Composer.
- Generate companion font files (see doc/FONTS.md).
- Run the minimal script using the generated
K_PATH_FONTS path.
composer require tecnickcom/tc-lib-pdf
Or add to your composer.json:
{
"require": {
"tecnickcom/tc-lib-pdf": "^8"
}
}
Quick Start
This example assumes the script lives in the project root; adjust the autoload.php and K_PATH_FONTS paths otherwise.
…
getOutPDFString() returns the raw PDF bytes. renderPDF() streams those bytes to the browser; to store them in a file or send them as an attachment, keep the returned string.
Note: realpath() returns false when the fonts directory does not exist. A K_PATH_FONTS error on first run means the fonts have not been generated (see doc/FONTS.md).
Examples
The examples directory holds runnable scripts for the supported features.
Starting points:
Topic groups:
- Document basics (layout, headers/footers, cells, colors, images, text rendering)
- Standards and compliance (PDF/X, PDF/UA, PDF/A workflows)
- Security and signing (encryption, PAdES/PKCS#7 signatures, timestamps,