Cycling through all six. Tap any point to stop.

Measured on six things

Eighteen PDF tools in one native Mac window: merge, split, compress, OCR, Bates numbering, forms, signing and redaction. Offline. $29 once.

Security

Strong product-level story: no-network-entitlement engine, Ed25519-signed certificates, DMARC/SPF. But the site ships zero security headers — no HSTS, CSP, frame protection or Referrer-Policy — and no SOC 2/ISO/pen-test is published.

Screenshots

1 / 3

Basalt

About this app

Basalt puts 18 PDF tools in one native Mac window: merge, split, compress, OCR, Bates numbering, forms, signatures and comparison. Redaction is the core. Redaction removes the text and pixels from the file itself, not a black box drawn over text, and strips metadata, XMP, attachments and hidden layers. A verifier re-opens the output with an independent parser and proves the job before any file is written, then issues a certificate you can check with shasum and openssl. The document engine has no network access at all. No cloud, no account. $29 lifetime, free for 24 hours, macOS 13 or later.

Key features

1Redaction that destroys text and pixels from the file itself, with a verifier that re-opens the output before writing.
2Ed25519-signed redaction certificates verifiable with shasum and openssl, no Basalt required.
318 PDF tools in one native window: merge, split, compress, OCR, Bates numbering, forms, signatures, comparison.
4No-network-entitlement engine enforced at code-signature level; no cloud, no account, documents stay local.
5$29 lifetime license for up to 3 Macs, free for 24 hours, macOS 13+, Apple Silicon and Intel.

Target customer profile

Drawn from the product itself, not from a survey.

Scout Review

Written by AI from measured evidence, scored out of 100.

Basalt is a native Mac PDF toolkit with 18 tools and a redaction engine that destroys content rather than covering it, then proves the job with an Ed25519-signed certificate you can verify with shasum and openssl. The product story is unusually specific and credible: a no-network-entitlement engine, byte-reproducible output, and a verifier that refuses to write a file if any check fails. The site is fast (Lighthouse 97/98) and the demo does real work. Weaknesses are concentrated on the marketing surface — noisy spiraling background text, an ungrouped eight-item nav, an unexplained 'CLICK & HOLD', zero security headers, and no published compliance certifications. At $29 lifetime with a 24-hour trial, the value proposition is sharp.

Measure by measure

Usability

18 tools in one native window, no account, 24-hour free trial, Homebrew install — low friction to value. The numbered redaction demo explains the core feature well. 'CLICK & HOLD' is unexplained on first view.

Design

Coherent blue branding and a real redaction demo instead of stock imagery. Undermined by spiraling background text that fights the headline and an eight-item nav with no grouping or active state.

Speed

Lighthouse 97 mobile / 98 desktop, LCP 1.3s, CLS 0, TBT 174ms. A 19 MB native download with no cloud round-trips. Genuinely fast on both the site and the delivery model.

Security

Accessibility

Lighthouse 95/100 with only two failing audits (unnamed ARIA tooltips, missing main landmark). Site claims full keyboard control and VoiceOver labelling in the app. No WCAG statement or multi-language support published.

Growth

Sharp, specific wedge: redaction that destroys content and proves it with a verifiable certificate — a real high-stakes legal problem. $29 lifetime vs. subscription incumbents. Early (domain ~0.2 years) but the idea has room.

Improvement areas

Marketing site ships zero security headers (no HSTS, CSP, frame protection, Referrer-Policy) despite being a security product.
No published SOC 2, ISO 27001, pen-test or bug bounty to back the security claims.
Hero readability suffers from spiraling background text; nav lacks grouping and active states.
Two failing Lighthouse a11y audits (unnamed ARIA tooltips, missing main landmark); no WCAG statement.

Design & Usability

Basalt's site has a clear identity — deep blue, watermark text, a real redaction demo with numbered TEXT/PIXELS/HISTORY explanations — and it earns points for showing the product instead of stock photos. But the spiraling background text actively fights the headline, the eight-item nav has no grouping or active state, and 'CLICK & HOLD' is an unexplained affordance on first view. Usability is stronger: 18 tools in one native window, no account, a 24-hour free trial, and a Homebrew cask for the terminal crowd. The numbered demo does real work explaining the core feature. The friction is mostly on the marketing page, not the product.

Speed & Security

Speed is the standout: Lighthouse 97 mobile / 98 desktop, LCP 1.3s, CLS 0, TBT 174ms, and a 19 MB native download with no cloud round-trips. Security is a split verdict. The product story is genuinely strong — a no-network-entitlement engine enforced at code-signature level, Ed25519-signed redaction certificates verifiable with shasum and openssl, SPF and DMARC in place. But the marketing site ships zero security headers: no HSTS, no CSP, no frame protection, no Referrer-Policy, no X-Content-Type-Options. Four of twelve checklist points. No SOC 2, ISO or pen-test is published. The app is hardened; the site serving it is not.

Accessibility & Growth

Accessibility lands at 80: Lighthouse 95/100 with only two failing audits (unnamed ARIA tooltips, missing main landmark), and the site claims full keyboard control and VoiceOver labelling in the app. No WCAG statement or multi-language support is published, which caps it below excellent. Growth is the most interesting dimension. Basalt names a real, high-stakes problem — PDF redaction that leaves text recoverable — and answers it with destruction plus a machine-verifiable certificate. That's a specific wedge aimed at legal and paralegal users, priced at $29 lifetime against subscription incumbents, with 18 adjacent tools to expand into. The domain is roughly 0.2 years old, so traction is early, but the idea has clear headroom in a category where trust is the product.

Conclusion

If you handle documents where a leaked SSN or settlement figure is a career-ending event, Basalt's destroy-and-prove approach is the right shape of solution, and $29 lifetime is almost suspiciously cheap. The 24-hour free trial means you can verify the certificate flow yourself before paying. The caveats are real but fixable: tighten the hero, group the nav, label the hold button, and put HSTS and a CSP on the marketing site. None of those touch the engine. The engine is the product, and the engine is the part that looks genuinely well-built.

Suggestions for improvement

Add HSTS, CSP, X-Content-Type-Options, Referrer-Policy and frame protection to the marketing site — the app is hardened, the site isn't.
Fix the two failing a11y audits: give ARIA tooltips accessible names and wrap the page in a <main> landmark.
Replace or heavily reduce the spiraling background text — it competes with the headline and buttons in the hero.
Label the 'CLICK & HOLD' control with what it actually does; unexplained affordances cost conversions.

How we score

Alternatives comparison

Named competitors, point by point. Nobody paid to appear here or to be left out.

	Basalt
Redaction method	Destroys text and pixels from the file; verifier re-opens output before writing	Not specified in provided data
Proof / certificate of redaction	Ed25519-signed JSON + PDF certificate, verifiable with shasum and openssl	Not specified in provided data
Network / cloud dependency	No network entitlement; no cloud, no account, fully offline	Not specified in provided data
Pricing model	$29 lifetime, up to 3 Macs, free 24-hour trial	Not specified in provided data
Tool breadth	18 tools in one native window (merge, split, OCR, Bates, forms, signatures, compare, scripts)	Not specified in provided data