An evidence bundle is a PDF with an order, a continuous page number and a clean set of properties. The chain is: turn photos and scans into pages, merge them in exhibit order, number every page, split out what should not be served, clear the author fields, then encrypt. All of it runs in the browser.
The order is not optional. Number after merging, because numbering files separately gives every exhibit a page 1. Split before encrypting, because every PDF tool refuses an encrypted file. Clear metadata before sending, because a merge and a numbering pass can write a producer string into the output. And keep a master bundle that nobody edits, so the served set can always be regenerated. Write the master's page count down before splitting, because it is the only reliable check that nothing was lost in the ranges.
1. Turn photos and scans into pages
Evidence arrives as a mix of scanned PDFs and phone photographs of letters, notices and damage. PDFs can go straight to the merge step. Loose images need Image to PDF, which places each photo on an A4 or Letter page, with portrait or landscape, a margin, and a choice between Contain and Cover. Contain keeps the whole photograph visible, which is the safer choice when the edges of the page matter; Cover fills the sheet and crops, which should only be used when nothing at the edge is evidence.
Drag the cards into the order the exhibit should read before exporting. The result has no text layer, so a photographed letter is an image of a letter and cannot be searched until OCR runs over it later. Nothing is uploaded.
Image to PDF
Put photographed exhibits on numbered A4 or Letter pages, in the order you drag them.
2. Merge in exhibit order
Merge PDF joins the separate exhibits into one bundle. The cards can be reordered, and pages are copied as they are, so a contract keeps its layout and its selectable text. Links and bookmarks survive the merge. Put the bundle in the order the reader will expect: index or cover first, then exhibits in the order they are cited, then the certificates and correspondence.
There is one blocker worth knowing before you start. An encrypted PDF cannot be read by the merger, so a password protected exhibit has to be unlocked first, and the unlocked copy is what goes into the bundle. Merging is also a one-way assembly: the bundle is a new file, and the individual exhibits should be kept as the source set in case the order has to change.
Merge PDF
Join the exhibits into one bundle, with pages copied exactly as they are.
3. Number every page
Add Page Numbers draws a number on each page as selectable text, so it stays searchable and does not flatten the page. Choose one of six positions, a font from Helvetica, Helvetica Bold, Times Roman or Courier, a size from 8 to 24 pt, and a starting number. Skipping the first page is useful when the cover should not carry a number, and the numbering then starts at the value you set on the second page.
What the tool cannot do is the part most legal teams actually want. There is no prefix field, so Exhibit A, Schedule 2 and Bates strings such as ABC000123 are impossible; only a bare number, Page n, n / total or Page n of total can be produced. If the filing requires Bates numbering, that work belongs in a document management system before the PDF reaches this chain, because renumbering afterwards means rebuilding the bundle.
Add Page Numbers
Continuous numbers with a starting value, six positions and a skipped cover page.
4. Split out what should not be served
Split PDF takes a range expression such as 1-3, 5, 8-10 and writes one file per segment. That is how one master bundle becomes a served set and a withheld set without editing either by hand. Pages are copied, not re-rendered, so text and links remain intact. An encrypted PDF has to be unlocked before it can be split.
Two habits prevent the usual mistake. Keep the master bundle untouched and regenerate the sets when something changes, rather than patching a copy that has already gone out. And remember that splitting creates absence, not protection: a page removed from one copy is still present in every copy that was sent earlier. If a page should never have been in the bundle, the fix is to rebuild from the master, not to trim the served PDF.
Split PDF
Cut the master bundle into a served set and a withheld set by page range.
5. Clear the document properties
PDF Metadata clears the Title, Author, Subject, Keywords, Creator and Producer fields that a reader shows under document properties. In practice this is where a laptop account name, a firm name or a matter number travels with a file that was supposed to be anonymous. Check the panel after the merge and the numbering pass, because each write can add a producer string.
Be precise about what this is. Clearing properties is not redaction: a name printed on the page remains on the page, and nothing here draws a black box over text. The tool also does not reliably remove an XMP packet written by a scanner, so a scan that carries its own metadata is better re-exported by the scanner software with metadata turned off. Stripping is one-way, so keep the original file.
PDF Metadata
Clear the author, title, subject and producer fields that travel with the file.
6. Encrypt before sending
Protect PDF writes AES-256 with qpdf in the browser. Set an open password for the recipient, an optional owner password for permissions, and decide whether printing, copying and editing are allowed. The password and the file never leave the machine, so there is no server copy to leak and no upload step anywhere in this chain.
Three limits decide how you use it. There is no password recovery, so a lost password loses the bundle for everyone, and the password should travel by a different channel than the file. The permission switches are enforced by the reader, not by cryptography, so treat them as a signal. And only PDF can be encrypted here: audio, video and image exhibits cannot be password protected by these tools and need a dedicated encrypted archive. Encrypt last, because no other tool on this page can open a protected file.
Protect PDF
AES-256 with print, copy and edit permissions, entirely on your device.
What this chain cannot do
- No Bates numbering or Exhibit prefixes. Page numbers are plain numbers with a starting value, nothing more.
- No redaction. Nothing blacks out text, removes a signature or hides a name printed on the page.
- No proof of integrity. There is no hash, digital signature or timestamp, so the tools cannot show that a bundle was not altered.
- Metadata stripping is not complete. Scanner-written XMP is not reliably removed, and clearing properties leaves the visible page untouched.
- Encrypted files block every step. Merge, split, number and read all require an unlocked copy first.
- No password recovery. A lost AES-256 password loses the bundle permanently.
- Only PDF can be encrypted. Audio and video exhibits need a separate encrypted archive.
- No editing of document text. These tools assemble, number and lock pages; they do not change what a page says.
- Handwriting OCR is unreliable. Printed scans can be searched after PDF to Text, but handwritten notes come back as fragments.