PDF Markup Software: What to Check Before You Subscribe

If you bought a perpetual licence for PDF markup software, check whether it still exists.

Bluebeam discontinued perpetual licences outright, and Revu 20 holdouts lose support on 31 December 2026. Drawboard moved from a one-time purchase to a subscription and took a fair amount of goodwill with it. Adobe raised Acrobat Standard pricing for Teams and Enterprise on 1 April 2026, citing "value that has been added over time." PDF Expert added a subscription alongside its lifetime option, which is the polite version of the same move.

This is the actual state of the market, and it is why the interesting question is no longer "which tool has the most highlighters." Every tool has highlighters. The questions worth asking before you commit are narrower and less fun, and most comparison articles skip all three.

Quick answer: PDF markup software in 2026 splits on three axes that matter more than the feature list: the licence model (perpetual options are disappearing), annotation portability (whether your comments survive export as standard PDF annotations), and where processing happens (on your device or on someone's server). Test all three before you subscribe.

Key takeaways:

• Licence: perpetual licences are an endangered species — PDF-XChange Editor, PDF Expert, Foxit and PDF Studio still sell them; Adobe, Bluebeam and Drawboard do not.
• Portability: some tools flatten comments into pixels or keep them in a proprietary layer, so run a four-minute export round-trip test before committing.
• Privacy: server-based tools upload your whole file and keep it for a stated window; client-side tools like OxygenPDF never transmit it at all.
• Price: the free tier of Acrobat Reader already covers basic markup, and the cheapest serious paid option is a one-time $62 — not a $20-a-month subscription.

If you want the mechanics of how annotations work rather than which product to buy, that is a different post. This one is about the purchase.

What It Costs, Without the Asterisks

List prices as of September 2026, linked to each vendor's own pricing page — annual-billing and month-to-month rates differ, so compare like with like:

Two things fall out of that table. The free tier of Adobe's own Reader includes a complete annotation set — highlights, sticky notes, stamps, text boxes, drawing tools, and reply threads — which is more than most people who are about to pay $19.99 a month actually need. And the cheapest serious option is a one-time $62 for PDF-XChange Editor, if you are on Windows and can live with an interface that has not been redesigned in a while.

The subscription math is worth doing once, out loud. Acrobat Pro at $19.99 a month is roughly $720 over three years. PDF-XChange is $62, once, for the same three years. PDF Expert's lifetime tier is $139.99 against $79.99 a year, so it pays for itself in under two. None of that makes subscriptions wrong — you are paying for the collaboration features the next section is about — but it does mean "which is cheapest" and "which subscription is cheapest" are different questions with different answers.

Bluebeam's pricing looks absurd next to the rest until you remember what it is for. If you are doing quantity takeoff on construction drawings with calibrated measurements, it is the standard and the $400 a year is not the expensive part of that project. If you are marking up a contract, you are buying a bulldozer to plant a window box.

Does Your Markup Survive Being Sent Somewhere Else

This is the check almost nobody runs, and it is the one that ruins work.

Markup lives on the PDF's annotation layer, separate from the page content underneath. That separation is what lets you delete a highlight without damaging the document. It also means every annotation depends on the next application honouring that layer the same way — and they do not all honour it equally.

Two specific failure modes to test before you commit:

Silent flattening on export. Some web-based tools flatten annotations into the page when you download, which converts editable comments into baked-in pixels. The file looks right. Your reviewer cannot reply to a single note, because there is nothing left to reply to. Flattening on purpose is a genuinely useful final step before archiving or printing. Flattening because your tool decided to is data loss.

Proprietary comment layers. Tools with their own collaboration systems sometimes store comments outside the standard annotation structures, so the conversation is visible in that product and invisible in every other. Lumin's help center, for instance, treats exporting your annotations as a separate manual step rather than something that travels with the file. If your counterparty opens the file in Acrobat and sees a clean document, your redlines did not arrive.

The test takes four minutes and settles it. Mark up a page in the candidate tool, export, open the result in a different application, and try to reply to your own comment. If the annotation is gone, uneditable, or invisible, you have your answer before the trial expires rather than after the deal closes.

While you are testing, check whether the tool has a comment list at all. Apple Preview handles basic markup perfectly and has no comment pane, which is fine for four notes and a scavenger hunt at forty. Threaded replies, comment export to a spreadsheet, and shared review links are the real dividing line between the free tools and the paid ones — not the drawing tools.

Where the File Goes When You Click Process

Every markup tool falls into one of three models, and the model matters more than the feature list for anything sensitive.

Processed on your device. The file never leaves. Zero bytes uploaded. Desktop applications like PDF-XChange, and browser-based tools built on WebAssembly, work this way.

Uploaded and retained for a window. WebToolVerse's May 2026 review of eight popular PDF and image tools' privacy policies found every server-based one uploads the complete file, with stated retention running from about an hour up to 48 hours: Smallpdf says roughly one hour, iLovePDF up to two, Sejda about two, CloudConvert and Convertio up to 24, and Adobe's online tools commit only to "a short time period."

Uploaded under broad terms. Retention is only half the question; the other half is what the terms let the vendor do with the file while they have it. Some policies are vague about whether uploaded documents feed AI or ML training, and Adobe's online terms are broad enough that the question is worth asking. Acrobat's AI features require cloud upload by design — the document has to be on Adobe's servers for the assistant to read it.

None of this makes the server-based tools dishonest. One-hour retention, disclosed plainly, is a reasonable product. The point is that it is a decision you are making on behalf of whatever is in the document, and for some documents there is no acceptable retention window.

Compliance Is Architecture, Not a Promise

Here is the part that changes how the purchase looks to anyone in a regulated role.

A hospital uploading patient records to a cloud PDF tool creates a HIPAA obligation. A school putting student transcripts through a web annotator creates a FERPA obligation. A European company running employee contracts through an online service creates a GDPR processing event with a third-party controller. The obligation attaches to the upload, not to the outcome — it exists whether or not anything ever goes wrong.

Client-side processing does not satisfy those obligations. It avoids creating them. Nothing was transmitted, so there is no processor to vet, no DPA to sign, no retention window to audit, and nothing to disclose in a breach that happens at someone else's company.

The rule of thumb worth writing down: if the document contains a social security number, a financial account number, medical information, or a legal signature, it should not leave the machine. Tax returns, medical records, financial statements and employee files are all in that category. Marketing collateral is not, and treating it as though it were just makes people work around you.

And a privacy claim in this category is checkable, which is unusual. Open DevTools, go to the Network tab, clear the log, and run the tool. A client-side tool transfers zero bytes of PDF data. A server-based one transfers your whole file. Better still, load the page and then disconnect from the internet — if it still works, the processing is genuinely local. That is an architecture you can verify rather than a policy you have to trust.

Annotation Handling Is Its Own Attack Surface

One more thing to weigh, because it cuts against the "desktop is inherently safer" instinct.

Annotation parsing has been a recurring source of vulnerabilities. CVE-2024-41834 covered an out-of-bounds read in Adobe Acrobat Reader's annotation handling that could disclose sensitive information. Foxit PDF Reader had several of the same class — CVE-2024-30350, CVE-2024-30335, CVE-2024-9246. Kofax Power PDF had two more in AcroForm annotation handling. These are triggered by opening a maliciously crafted file, which is exactly what a markup tool does all day.

Foxit's response is the most direct in the category: PDF Action Inspector, shipped in Editor 2026.1, scans documents for embedded JavaScript and self-modifying content before you open them. If you receive PDFs from people you do not know, that feature is worth more than a drawing tool. Failing that, stripping active content out of the file before you work on it is the cheap version of the same defence.

The risk profiles differ rather than one being universally lower. With cloud tools, you add server-side breaches and third-party access to your exposure. With local tools, the exposure is the file you were sent.

Mark Up in the Browser, and Verify It

Edit PDF does highlights, notes, shapes, text and freehand ink, and it runs entirely in your browser. No upload, no account, no daily cap — and because there is no server, there is no retention policy to read.

The honest limits, since this is a buyer's guide: there are no shared review links and no multi-user comment threading here. That is a genuine advantage of the paid desktop tools, and if your workflow is five stakeholders converging on one master file with tracked responses, buy Acrobat Pro or Foxit. What you get instead is markup on documents you were never going to upload in the first place, with annotation removal when a round of comments needs clearing and proper redaction when covering something up is not enough.

Run the four-minute round-trip test on it like you would on anything else. That is the whole point of recommending the test.

Frequently Asked Questions

Is free PDF markup software good enough?

For solo markup, usually yes. Acrobat Reader's free tier and Apple Preview both cover highlights, sticky notes, text boxes and drawing. What paid tools add is comment management — threaded reviews, shared links, export to a spreadsheet — not better pens. If you mark up alone, free is enough.

Do PDF annotations show up in every PDF viewer?

Standard annotation types — highlights, notes, stamps, ink — are part of the PDF spec and display in any compliant viewer. Comments stored in a tool's proprietary collaboration layer may not. Export a marked-up file and open it in a different app before you rely on it.

What is the difference between marking up and editing a PDF?

Markup sits on the annotation layer above the page: highlights, comments and shapes that can be moved, replied to or deleted without touching the content. Editing changes the page content itself — the text and images. Markup is for review; editing is for revision.

Is it safe to mark up confidential PDFs with an online tool?

It depends where the processing happens. Server-based tools upload the whole file and retain it for a stated window, which creates a third-party processing event. Client-side tools process in your browser and transmit nothing — verifiable in the Network tab. For regulated documents, local is the defensible default.

Which PDF markup tools still offer a one-time purchase?

As of September 2026: PDF-XChange Editor ($62, Windows only), PDF Expert ($139.99 lifetime alongside its subscription, Apple only), and perpetual options from Foxit and PDF Studio. Adobe, Bluebeam and Drawboard are subscription-only. The perpetual list shrinks every year, so treat it as a snapshot.

Does flattening a PDF remove the comments?

It removes them as comments. Flattening bakes annotations into the page as pixels — still visible, but no longer selectable, editable or replyable. That is exactly what you want before archiving or sending a final version, and exactly what you do not want mid-review.

The Short Version

Check the licence model, run the export round-trip test, and find out where the file goes when you click process. Those three checks take an afternoon and eliminate most of the field. The drawing tools, which is what every comparison chart spends its columns on, are the part that is already fine everywhere.