Montecristo opens your documents instantly, lets you annotate, fill
in and protect them — and when there's a 3D model inside, it spins
right in front of you. Native, light, no telemetry.
U3D and PRC 3D models embedded in PDFs — finally on Linux too
Five things that make the difference between a viewer and a working tool.
3D inside PDFs The headline feature
That 3D model was always there. Now you can see it.
Technical datasheets, CAD drawings, scientific papers: many PDFs
contain 3D models that most readers show as an empty rectangle.
Montecristo decodes them — both U3D and PRC — and puts them in
your hands.
Rotate, pan, zoom with the mouse, smoothly.
Preset views X, Y, Z and isometric, with 60 fps animated transitions.
Four render modes: solid, wireframe, vertices, transparent.
Original colors, materials and textures from the model.
Broken-file safe: 3D runs in an isolated process; a corrupted model can't take the reader down with it.
Annotations
Write on the PDF like paper. Readable everywhere.
Highlight, underline, strike through, comment, draw. Every mark is
saved as a standard PDF annotation: whoever receives the file
sees it in Acrobat, Foxit, or any other reader.
Highlight, underline, strikeout and squiggly, anchored to the text.
Move, resize, rotate, copy and paste what you've drawn.
Quick palette and a free color picker.
Non-destructive saving: the original file is never rewritten in place.
Forms
Forms you can fill in. That do the math themselves.
Text fields, checkboxes, radio buttons, dropdowns, list boxes:
all fillable right on the page. If the form has calculations or
validation logic, Montecristo runs it.
Form JavaScript: totals, validation and calculated formats, run automatically.
Tab and Shift+Tab navigation, keyboard activation.
A document can contain links to other files, scripts and
commands. Montecristo treats them for what they are: untrusted
content. You decide what's allowed to happen.
No program is ever launched from a link in the document.
Separate permissions for internal jumps, other documents, the web, and new windows.
Form JavaScript can be switched off with one click.
Password-protect a PDF, with strength measured in bits as you type it.
Zero outbound connections: there is no networking code in the app at all.
Digital signatures for documents: coming soon.
Performance
A thousand pages, zero waiting.
Montecristo only renders what you're actually looking at, and
prepares the next pages ahead of time. Scrolling stays smooth
even on the heaviest documents, and the interface never freezes
while it works.
Rendering on a separate thread, the next 6 pages pre-loaded.
Memory freed for pages that scroll out of view.
Performance panel: memory and cached pages, per tab.
MuPDF engine: compact, fast, battle-tested for years.
The philosophy
Three principles, in this order. If a new feature breaks one of them, it doesn't ship.
01
Actually light
Opens instantly and stays nimble even with documents thousands of
pages long. No browser wearing an app costume: underneath is
MuPDF, a rendering engine built to do exactly this, and do it well.
02
Native, not a compromise
A real GTK4 interface on Linux, the same care on Windows, with a
native title bar and system snap. No Electron, no wrapper: it
behaves the way your operating system taught you to expect.
03
Respects the reader
Zero telemetry, zero accounts, zero ads, zero connections.
What you read stays on your computer. Full stop.
And then, everything else you'd expect
The basics of a good reader, built with the same care.
Multiple tabs
Many documents, one window. Drag files in: each opens its own tab, and a file that's already open won't be duplicated.
Not just PDF
Also reads EPUB, XPS and OpenXPS, CBZ comics, FictionBook and SVG, in the same interface.
Search and selection
Ctrl+F finds it instantly. Select text with the mouse and copy it wherever you need.
Outline and links
Clickable side outline, internal and external links, jumps between linked documents.
Images, one click away
Right-click an image on the page: copy it, save it, or read its EXIF data.
Watermark
Add a text watermark with the size, color, opacity and rotation of your choice.
Source view
For those who want to look under the hood: the PDF as indented text, editable object by object.
Zoom and rotation
Fit width or page, Ctrl+wheel zoom, instant rotation, middle-button pan.
Digital signatures Coming soon
Verify signatures on documents you receive, and sign your own PDFs with a certificate. Among the next things on the list.
English and Italian
Translated interface, with more languages on the way.
Download
Three builds of the same reader. They differ only in which modules are
compiled in — pick how much of a PDF you want this program able to
touch.
All three are hardened builds. Symbols stripped, no
debug logging compiled in, hidden symbol visibility, aggressive
inlining. Hardening is not something you choose here: nothing is
published without it.
Full
Everything
The whole reader. 3D models (U3D and PRC) rendered in an isolated
process, AcroForm fields with their JavaScript, and links that can
leave the document — each behind its own permission under
Settings > Security.
Minimal
No 3D
Full, minus the 3D modules: the U3D decoder, the PRC parser and the
GL renderer are not compiled, and the vendored 3D library isn't
shipped. A /3D annotation falls back to the placeholder
box MuPDF draws itself. The package is about 6 MB smaller.
Safe
Smallest attack surface
For PDFs you don't trust. Minimal, minus everything a document can
use to make the program act: no AcroForm fields, no JavaScript at
all — the interpreter isn't even compiled into MuPDF — no
annotation tools, and no link that leaves the open document, not
even behind a confirmation dialog. There is no dialog, because
there is no code behind it. Annotations already in the file stay
visible — MuPDF draws them as part of the page — you just
can't touch them, and this build never parses them.
What each build contains
Module
Full
Minimal
Safe
Reading, printing, 6 formats
Yes
Yes
Yes
Text search and selection
Yes
Yes
Yes
Annotation tools (markup, notes, drawing)
Yes
Yes
Not compiled
Annotations already in the file
Read and editable
Read and editable
Visible, never parsed
Passwords and permissions
Yes
Yes
Yes
Protected Mode
Yes
Yes
Yes
Links within the document
Yes
Yes
Yes
3D models (U3D, PRC)
Yes
Not compiled
Not compiled
AcroForm fields
Yes
Yes
Not compiled
JavaScript in forms
Optional, on by default
Optional, on by default
Engine not compiled
Links out of the document
Per-action permission
Per-action permission
Not compiled
Hardening
Always on
Always on
Always on
The three install side by side and share nothing — not a file, not a
setting. That's deliberate: keep Minimal as your everyday reader and
open the attachment you weren't expecting with Safe, from the same
right-click menu. On Linux they are three packages
(montecristo, montecristo-minimal,
montecristo-safe); on Windows, three folders.
Linux
.deb package
For Ubuntu and Debian-based distros. Install with a double-click or apt.
No Windows package has been published yet, for any build. The
script exists but needs an MSYS2/UCRT64 machine to run:
.\scripts\package_windows.ps1 -Variant full
Linux
.deb package
For Ubuntu and Debian-based distros. Install with a double-click or apt.
No Windows package has been published yet, for any build. The
script exists but needs an MSYS2/UCRT64 machine to run:
.\scripts\package_windows.ps1 -Variant minimal
Linux
.deb package
For Ubuntu and Debian-based distros. Install with a double-click or apt.
No Windows package has been published yet, for any build. The
script exists but needs an MSYS2/UCRT64 machine to run:
.\scripts\package_windows.ps1 -Variant safe
Every checksum above is also published as a file, so you can verify a
download without copying hex by hand:
SHA256SUMS ·
MD5SUMS.
Put the file next to what you downloaded and run
sha256sum --check --ignore-missing SHA256SUMS.
Changelog
History of published versions. Full detail in the repository.
Version
Date
Highlights
0.2.0
2026-10-02
Three builds instead of one — Full,
Minimal, Safe — which differ
only in which modules are compiled in, and install side by
side without sharing a file or a setting. All three are
hardened; the earlier claim that published packages were built
without hardening was simply wrong. The Safe build drops the
3D modules, AcroForm fields, the JavaScript engine (MuJS isn't
compiled at all), the annotation tools, and every link action
that leaves the document.
0.1.19
2026-09-30
Rebrand to Montecristo (app ID, icons, .desktop entry). Fixed a
packaging bug where the runtime anti-debug check
(ptrace-based, Linux only) exited immediately on
systems where ptrace is restricted for reasons
unrelated to an actual debugger — the app simply wouldn't
start after install, with no visible error. That check has
been disabled on Linux; the rest of the hardening build is
unaffected.
0.1.18
2026-09-28
First packaged build (.deb/.tar.gz) and site published.
Italian/English localization. Fixed 3D model (U3D) colors and
transparency. Fixed a page not rendering after a scrollbar
drag; reopening an already-open file now focuses the existing
tab instead of duplicating it. Password strength shown in
bits, saving with imported annotations, viewer notes saved as
standard PDF comments.
0.1.14
—
"Fit width" zoom centers the page horizontally. Hand-drawn
icons wired into the build.
0.1.13
—
First version with an explicit SemVer number.
earlier
—
157 commits with no explicit versioning: a GTK4 + native
MuPDF viewer for Linux built from scratch — text
search/selection, clickable links, U3D/PRC 3D annotations,
password-protected PDFs, settings, document properties.