PDFShift

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the HTML-to-PDF endpoint that replaces PDFShift.

This is the smallest useful service on this site: **one endpoint, one browser pool.** The value is entirely in the operational details.

STACK
- Node 20+ with Fastify
- Playwright with headless Chromium
- SQLite through better-sqlite3 for the job records
- Caddy in front

THE ENDPOINT
- POST with either HTML or a URL, plus options: format, margins, landscape, header and footer templates, scale, and whether to wait for the network to settle
- Returns a job id; the document is fetched separately. **Never render inside the request** — a synchronous endpoint that takes eight seconds under load is an endpoint that times out under load
- A webhook or a poll for completion

THE BROWSER POOL, WHICH IS THE WHOLE OPERATIONAL PROBLEM
- A fixed number of contexts, sized to available memory rather than to CPU. **Chromium wants several hundred megabytes per instance and it grows**
- Recycle every N documents and after any timeout. A pool that runs for a week without recycling will exhaust the machine
- A per-job timeout that kills the page, not one that waits politely
- A queue with a depth limit that returns a clear error when full, rather than accepting work it cannot do

CORRECTNESS
- Wait for `document.fonts.ready` and for images, explicitly, before printing. **Text in a fallback font is the single most common defect in generated PDFs**
- Self-hosted fonts embedded in the template
- Honour print CSS: `@page` size and margins, avoid breaking inside rows, running headers with page numbers
- Set an explicit viewport and device scale factor, because the defaults change between browser versions and your output changes with them

SECURITY, AND THIS ONE IS SERIOUS
- **A service that fetches an arbitrary URL and renders it is a server-side request forgery engine.** Block private address ranges, the cloud metadata endpoint, localhost, and anything resolving to them after redirects. Re-check after every redirect, not only on the first URL
- Disable JavaScript unless the caller explicitly asks for it, and treat that as a privileged option
- Run the browser unprivileged in a container with no network access to anything internal
- Cap page count, document size and render time

OPERATIONS
- Store the job, the options and the hash of the output. Deduplicate identical inputs
- Signed expiring URLs for retrieval, and a retention sweeper
- Metrics: queue depth, render duration percentiles, timeout rate, and pool restarts. **The timeout rate is the number that tells you the pool is too small** before customers do

WHAT MATTERS MOST
Blocking internal addresses after redirects, and recycling the pool. The first is a security boundary; the second is why it is still running next month.