By Matt Busel, who built the apps, crates and game he writes about · every number links to its source and every dataset is downloadable (methods) · corrections · featured in Kirino, gamebiz, This Week in Rust, New Mobile Life, By-Press
Rust PDF crates: PaperPilot hit HN, Python pulls 40x the downloads
On this page · 9 sections
- Key numbers
- PaperPilot is the pitch: PDFs for agents, no cloud, no C++
- By the numbers: Python is still 40x bigger
- The catch: a third of "Python PDF" is really C and C++
- Inside Rust: the new engines are growing 4x to 6x
- Who wins, who loses
- The pattern says: Python stays the interface, Rust takes the engine
- What this means for you
- Sources
Short answer: Rust is not winning PDFs yet. Over the last 30 days the 12 Rust PDF crates we tracked pulled 13.2 million downloads, while 7 Python PDF packages pulled 533.4 million, about 40x more. But the Rust side is the one growing fast, and our bet is that it ends up owning the engine underneath everything, including the Python wrappers.
TL;DR: PaperPilot, a pure-Rust PDF toolkit that ships as an MCP server, CLI, WASM page and desktop app, hit the Hacker News front page with 122 points on Oct 26 2026, 28 days after its repo was created. Python still dominates the registries: pypdf alone pulled 157.0 million downloads in 30 days, more than 11x every Rust PDF crate combined. Inside Rust, the newcomer hayro went from 77,000 weekly downloads in early August to 447,000 in the week of Oct 19, a 5.8x jump in eleven weeks.
Key numbers
| What | Number | Source, checked Oct 26 2026 |
|---|---|---|
| Python PDF downloads, 7 packages, Sep 26 to Oct 25 | 533,355,728 | ClickHouse public PyPI dataset |
| Rust PDF downloads, 12 crates, same 30 days | 13,214,368 | crates.io API |
| pypdf, 30 days | 157,013,001 | PyPI via ClickHouse |
| lopdf, 30 days (top Rust crate) | 5,269,640 | crates.io |
| hayro weekly downloads, week of Aug 3 vs week of Oct 19 | 77,263 to 447,459 (5.8x) | crates.io |
| Python downloads that go to C or C++ engines (pymupdf + pypdfium2) | 181.3 million (34%) | PyPI via ClickHouse |
| PaperPilot GitHub stars, repo age | 241 stars, created Sep 28 2026 | GitHub |
PaperPilot is the pitch: PDFs for agents, no cloud, no C++
PaperPilot by Krushna Vardhan Reddy sells one idea: one Rust engine, five surfaces. It runs as an MCP server for Claude Desktop or Cursor, a CLI, a browser tool compiled to WebAssembly, a Tauri desktop app and a local REST API.
The README's own line is "No Chromium, no C++ runtime, no cloud calls." Version 0.6 merges, splits, compresses, watermarks, scans for personal data and runs OCR through rten, a pure-Rust inference runtime.
That pitch landed: 122 points and 29 comments on Hacker News on Oct 26 2026, and 241 GitHub stars for a repo that is 28 days old. Every "upload your PDF" website just got a free, local competitor. That is the real story here, and it is bad news for the freemium PDF sites that monetize your contracts by holding them on their servers.
By the numbers: Python is still 40x bigger
We pulled 30 days of downloads, Sep 26 to Oct 25 2026, for the 12 Rust PDF crates with real usage and the 7 Python packages most people actually install. Same window on both sides, so the known 30% dip in the public PyPI dataset since September does not skew the ratio.
Result: 533.4 million Python downloads against 13.2 million Rust downloads. pypdf by itself, at 157.0 million, is 11.9x the entire Rust PDF ecosystem.
Even the deprecated PyPDF2, which tells you to move to pypdf, still pulled 14.0 million downloads in 30 days. That is more than every Rust PDF crate combined. Legacy pipelines never die; they just keep pulling.
The catch: a third of "Python PDF" is really C and C++
Look at who does the heavy lifting in Python. PyMuPDF wraps MuPDF, a C library. pypdfium2 wraps PDFium, the C++ engine inside Chrome. Together they pulled 181.3 million downloads, 34% of the Python total.
So when people say Python owns PDFs, what they mean is Python owns the steering wheel. The engine is decades-old C and C++, exactly the kind of code where a malformed file turns into a memory-safety bug. PDFs are attacker-controlled input by design: every invoice, resume and "signed contract" an agent opens is a file a stranger made.
That is the opening Rust is driving through. Not "rewrite your script in Rust", but "replace the engine under your script with one that cannot overflow a buffer".
Inside Rust: the new engines are growing 4x to 6x
The Rust numbers are small, but the slope is the story. Weekly downloads, comparing the week of Aug 3 with the week of Oct 19 2026:
- hayro (PDF rendering, first published Jul 22 2025): 77,263 to 447,459, up 5.8x.
- pdf-writer (low-level PDF writing): 143,539 to 555,189, up 3.9x.
- pdf-extract (text extraction): 219,629 to 427,654, up 1.9x.
- lopdf (the 2016 workhorse): 731,192 to 1,332,216, up 1.8x.
hayro and krilla both come from the same developer, LaurenzV, and together pulled 2.45 million downloads in 30 days. One person's crates now pull almost half of what lopdf, a nine-year-old project, does. That is what "open source moves faster than incumbents" looks like in a spreadsheet.
Caveat in the open: crates.io counts include CI runs, so a few big projects rebuilding constantly can inflate a crate. PyPI counts have the same problem. Neither side gets a pass, which is why we compare them in the same window.
Who wins, who loses
Wins: anyone shipping AI agents. An agent that reads PDFs needs a parser it can run on untrusted files without a sandbox the size of a container. A pure-Rust engine compiled to one binary or a WASM module is that parser. PaperPilot's MCP server is the template.
Wins: privacy. A WASM PDF tool processes the file in your browser memory. No upload, no "we may use your documents to improve our services".
Loses: the cloud PDF sites. Their whole model is getting your file onto their server. A free local tool that does merge, compress, OCR and redact in a tab is a direct hit on that funnel.
Loses, slowly: the C engines. They will not vanish, because 181 million monthly Python installs depend on them. But every new agent stack that picks a Rust engine is one fewer dependency on code nobody wants to audit.
The pattern says: Python stays the interface, Rust takes the engine
We have seen this movie. Python data tooling kept its API while the guts moved to Rust: pydantic-core, Polars, ruff, uv. Nobody has proven PDFs go the same way yet, but the setup is identical: a hot, hostile input format, a C core nobody loves, and a fast-growing set of Rust crates with clean APIs.
Our bet: within two years the most-downloaded new Python PDF package is a thin wrapper over a Rust engine. Watch hayro and krilla for the first PyO3 binding with real downloads; that is the starting gun.
More of our registry data: the crates tracker, the Rust hub, every Rust piece, our PyPI context-engineering numbers and why Rust alone did not fix container escapes.
What this means for you
If you are building an agent or app that reads user PDFs today: keep pypdf or PyMuPDF where they already work, but put new untrusted-file paths through a Rust engine (lopdf for structure, hayro for rendering, pdf-writer or krilla for output) or a local tool like PaperPilot. Do not send customer documents to a free PDF website.
If your Rust PDF build is the thing that is broken (linker errors, a WASM target that will not compile, a PyO3 wrapper that segfaults on import), we fix it: Fix my Rust build, $99, fixed within 24 hours or a full refund.
Not financial advice; download counts are a usage signal, not a forecast.
Sources
- PaperPilot on GitHub, README and repo stats, Oct 26 2026
- Hacker News front page, "PaperPilot: Zero-Cloud, Pure-Rust PDF Engine with WASM and MCP", Oct 26 2026
- crates.io API: lopdf, hayro, pdf-writer, pdf-extract, krilla, pdfium-render, printpdf, pdf_oxide, mupdf, genpdf, oxidize-pdf, pdf, pulled Oct 26 2026
- ClickHouse public PyPI dataset: pypdf, pymupdf, pypdfium2, reportlab, pdfminer.six, pdfplumber, PyPDF2, pulled Oct 26 2026
- hayro on GitHub and krilla on GitHub, Oct 26 2026
First published here on tensorust.com on Oct 26, 2026. Related: .
Up next
More on RustAI sandbox escapes: OpenAI wrote 8 of the 17,204 commits in the wallsOpenAI's agents broke out of Kata, gVisor and Docker. We counted a year of commits to 10 sandbox projects: 17,204. OpenAI wrote 8. One man wrote half of Docker.Read it next →Cite this
Free to cite and reuse under CC BY 4.0 with a link back. How it was collected: methods. Spotted an error? Corrections.
Did this answer your question?
Get the next one by email.
What my AI agents tried this week, with the real numbers: what worked, what flopped, what made money. One email when there is something worth reading.
No spam, never sold. Every email has a one-click unsubscribe.
What are people saying about this? Read and post on The Floor →
More: the author, related reading, share this, a free game
Try it yourself · Rust dev?
Check a crate before you depend on it
Release health, reverse deps, real downloads and the alternatives for 1000 crates.
In The Manual: on this topic
Explainers answer one question, short answer first. Guides walk you through it step by step.
- Explainer · Shipping and selling429 Too Many Requests: what it means and how long to wait
- Explainer · Shipping and sellingSnowflake ID vs UUID: which should you use?
- Explainer · Shipping and sellingUUID vs NanoID: which ID should you use?
- Explainer · Shipping and sellingUUIDv7 vs ULID: which time-sorted ID should you use?
Read next
- AI · Oct 25, 2026 · 10 min readAI sandbox escapes: OpenAI wrote 8 of the 17,204 commits in the walls
- Dev · Oct 24, 2026 · 13 min readOpenClaw got 591 advisories. 1 in 4 top npm installs is the real hole
- AI · Oct 26, 2026 · 6 min readContext engineering: pgvector up 74%, Pinecone down 36% on PyPI