PDF Markup Software: What to Check Before You Subscribe

If you bought a perpetual licence for PDF markup software, check whether it still exists.

Bluebeam discontinued perpetual licences outright, and Revu 20 holdouts lose support on 31 December 2026. Drawboard moved from a one-time purchase to a subscription and took a fair amount of goodwill with it. Adobe raised Acrobat Standard pricing for Teams and Enterprise on 1 April 2026, citing "value that has been added over time." PDF Expert added a subscription alongside its lifetime option, which is the polite version of the same move.

This is the actual state of the market, and it is why the interesting question is no longer "which tool has the most highlighters." Every tool has highlighters. The questions worth asking before you commit are narrower and less fun, and most comparison articles skip all three.

If you want the mechanics of how annotations work rather than which product to buy, that is a different post. This one is about the purchase.

What It Costs, Without the Asterisks

Two things fall out of that table. The free tier of Adobe's own Reader includes a complete annotation set — highlights, sticky notes, stamps, text boxes, drawing tools, and reply threads — which is more than most people who are about to pay $19.99 a month actually need. And the cheapest serious option is a one-time $62 for PDF-XChange Editor, if you are on Windows and can live with an interface that has not been redesigned in a while.

Bluebeam's pricing looks absurd next to the rest until you remember what it is for. If you are doing quantity takeoff on construction drawings with calibrated measurements, it is the standard and the $400 a year is not the expensive part of that project. If you are marking up a contract, you are buying a bulldozer to plant a window box.

Does Your Markup Survive Being Sent Somewhere Else

This is the check almost nobody runs, and it is the one that ruins work.

Markup lives on the PDF's annotation layer, separate from the page content underneath. That separation is what lets you delete a highlight without damaging the document. It also means every annotation depends on the next application honouring that layer the same way — and they do not all honour it equally.

Two specific failure modes to test before you commit:

Silent flattening on export. Some web-based tools flatten annotations into the page when you download, which converts editable comments into baked-in pixels. The file looks right. Your reviewer cannot reply to a single note, because there is nothing left to reply to. Flattening on purpose is a genuinely useful final step before archiving or printing. Flattening because your tool decided to is data loss.

Proprietary comment layers. Tools with their own collaboration systems sometimes store comments outside the standard annotation structures, so the conversation is visible in that product and invisible in every other. Lumin is explicit that its comments do not transfer to other PDF apps. If your counterparty opens the file in Acrobat and sees a clean document, your redlines did not arrive.

The test takes four minutes and settles it. Mark up a page in the candidate tool, export, open the result in a different application, and try to reply to your own comment. If the annotation is gone, uneditable, or invisible, you have your answer before the trial expires rather than after the deal closes.

While you are testing, check whether the tool has a comment list at all. Apple Preview handles basic markup perfectly and has no comment pane, which is fine for four notes and a scavenger hunt at forty. Threaded replies, comment export to a spreadsheet, and shared review links are the real dividing line between the free tools and the paid ones — not the drawing tools.

Where the File Goes When You Click Process

Every markup tool falls into one of three models, and the model matters more than the feature list for anything sensitive.

Processed on your device. The file never leaves. Zero bytes uploaded. Desktop applications like PDF-XChange, and browser-based tools built on WebAssembly, work this way.

Uploaded and retained for a window. A 2026 analysis of eight popular PDF tools found every server-based one uploads the complete file, with stated retention from immediately-after-processing up to 48 hours. Smallpdf says one hour, iLovePDF and Sejda two, Adobe's online tools 24, PDF Candy up to 48.

Uploaded under broad terms. The same analysis flagged two tools whose policies were unclear about whether uploaded files feed AI or ML training. Adobe's online terms were characterised as broad. Worth noting that Acrobat Studio's AI features require cloud upload by design — the document has to be on Adobe's servers for the assistant to read it.

None of this makes the server-based tools dishonest. One-hour retention, disclosed plainly, is a reasonable product. The point is that it is a decision you are making on behalf of whatever is in the document, and for some documents there is no acceptable retention window.

Compliance Is Architecture, Not a Promise

Here is the part that changes how the purchase looks to anyone in a regulated role.

A hospital uploading patient records to a cloud PDF tool creates a HIPAA obligation. A school putting student transcripts through a web annotator creates a FERPA obligation. A European company running employee contracts through an online service creates a GDPR processing event with a third-party controller. The obligation attaches to the upload, not to the outcome — it exists whether or not anything ever goes wrong.

Client-side processing does not satisfy those obligations. It avoids creating them. Nothing was transmitted, so there is no processor to vet, no DPA to sign, no retention window to audit, and nothing to disclose in a breach that happens at someone else's company.

The rule of thumb worth writing down: if the document contains a social security number, a financial account number, medical information, or a legal signature, it should not leave the machine. Tax returns, medical records, financial statements and employee files are all in that category. Marketing collateral is not, and treating it as though it were just makes people work around you.

And a privacy claim in this category is checkable, which is unusual. Open DevTools, go to the Network tab, clear the log, and run the tool. A client-side tool transfers zero bytes of PDF data. A server-based one transfers your whole file. Better still, load the page and then disconnect from the internet — if it still works, the processing is genuinely local. That is an architecture you can verify rather than a policy you have to trust.

Annotation Handling Is Its Own Attack Surface

One more thing to weigh, because it cuts against the "desktop is inherently safer" instinct.

Annotation parsing has been a recurring source of vulnerabilities. CVE-2024-41834 covered an out-of-bounds read in Adobe Acrobat Reader's annotation handling that could disclose sensitive information. Foxit PDF Reader had several of the same class — CVE-2024-30350, CVE-2024-30335, CVE-2024-9246. Kofax Power PDF had two more in AcroForm annotation handling. These are triggered by opening a maliciously crafted file, which is exactly what a markup tool does all day.

Foxit's response is the most direct in the category: PDF Action Inspector, shipped in Editor 2026.1, scans documents for embedded JavaScript and self-modifying content before you open them. If you receive PDFs from people you do not know, that feature is worth more than a drawing tool. Failing that, stripping active content out of the file before you work on it is the cheap version of the same defence.

The risk profiles differ rather than one being universally lower. With cloud tools, you add server-side breaches and third-party access to your exposure. With local tools, the exposure is the file you were sent.

Mark Up in the Browser, and Verify It

Edit PDF does highlights, notes, shapes, text and freehand ink, and it runs entirely in your browser. No upload, no account, no daily cap — and because there is no server, there is no retention policy to read.

The honest limits, since this is a buyer's guide: there are no shared review links and no multi-user comment threading here. That is a genuine advantage of the paid desktop tools, and if your workflow is five stakeholders converging on one master file with tracked responses, buy Acrobat Pro or Foxit. What you get instead is markup on documents you were never going to upload in the first place, with annotation removal when a round of comments needs clearing and proper redaction when covering something up is not enough.

Run the four-minute round-trip test on it like you would on anything else. That is the whole point of recommending the test.