Libreon: A Private Offline Office Suite for Android with No Ads and No Accounts

TL;DR: Libreon is a free GPL-3.0 Android office suite that opens, edits and saves Word, Excel and PowerPoint files plus PDF and text with no ads, no account, no trackers and no internet permission at all. Built on LibreOfficeKit and PDFium in Kotlin and Jetpack Compose, about 115 MB per ABI, Android 12 and newer. Full install guide, privacy design, architecture tour and honest beta limits inside.

What Libreon Is

Libreon offline office is a private, fully offline office suite for Android that opens, edits and saves Word, Excel and PowerPoint files, views and signs PDF documents, and handles plain text and Markdown, with no ads, no subscriptions, no trackers, no AI features and no internet permission at all.

That one sentence carries the whole pitch, so unpack it slowly. Libreon is a native Android app written in Kotlin with Jetpack Compose, currently in public beta at version 0.9.0 beta 5. It is free software under GNU GPL-3.0 or later. The parts that actually parse your documents aren’t new code. They are LibreOffice core reached through LibreOfficeKit with the Collabora Online web front end running locally in a WebView, and PDFium, the same PDF engine that ships inside Chrome, reached through a small JNI bridge. Around those engines sits a brand new shell: tabs, recents, file search, find in document, word counts, light and dark themes, and a recovery system that keeps unsaved changes alive even when Android kills the app in the background.

The project lives at https://github.com/jainiakhil/Libreon by developer Akhil Jain, with 35 commits and five beta releases in about two days at the time of writing, which tells you how fast the feedback loop is running. The tagline on the repository is three words long: Work freely. After a decade of office apps that treat a phone like a billboard with a document viewer attached, three words feel about right.

Why Your Phone Needs an Office App That Cannot Phone Home

Every Android user knows the drill the Libreon README opens with, because every one of us has lived it. You tap a Word file a club member sent you. A full screen ad plays. A Go Premium popup slides up. A sign in nudge follows. Then an AI assistant offers to summarise the document you haven’t even read yet. The document appears with a banner ad parked over the bottom third. To open a file you already own, you paid with attention, data and patience.

This didn’t happen by accident. It’s the business model. Desktop office software used to be a product you bought once. Mobile office software is a service you rent forever, monetised through subscriptions, advertising inventory, analytics pipelines and upsold AI credits. The document is the bait. You are the inventory. Microsoft 365 wants the subscription, Google Docs wants the account and the cloud corpus, WPS Office wants the ad impressions. Each one is excellent at editing documents, because each one has to be good enough that you tolerate the price around it.

Radio amateurs have a special reason to dislike this deal. Field work happens where the network doesn’t. A summit, a rural EmComm deployment, a ship at sea, a border crossing with no roaming, a concrete basement club meeting with one bar of signal. An office app that needs to phone a server to open a local file isn’t a tool, it’s a liability. The same instinct that makes hams keep paper duplicates of critical logs, run offline loggers for Field Day, and prefer tools that work with the cell network switched off applies to documents. Activation checklists, EmComm ICS forms, equipment inventories, antenna build notes, QSL card mail merges. These live as docx, xlsx and PDF files, and they need to open on a mountaintop.

Libreon answers with a clean room design and a permission manifest anyone can audit. Clean room here means what it says in the README. No code, resources or artwork were taken from any existing app. Existing apps were studied only to learn what features people expect. Everything is written from scratch or comes from properly licensed open source projects with a full license list in docs and on the in-app open source licenses screen. And the network story isn’t a policy promise, it’s an Android enforcement guarantee. The merged manifest explicitly removes the INTERNET permission, a CI check fails the build if any uses-permission appears, cleartext traffic is off, and a network security config denies everything. On Android that is checkable, not marketing. Open the manifest and the permission is absent, so the app physically can’t upload your documents, your signatures or your keystrokes no matter what a future update might want. The only web links in the whole app sit at the bottom of Settings, the GitHub page and a buy me a coffee banner, and they open in your browser only when you tap them.

There is an irony the author discloses upfront and deserves credit for. Libreon ships no AI inside, yet it was built with two AI coding assistants, Claude Code and Google Antigravity, while the developer designed, reviewed and tested on real phones. The AI wrote code, it didn’t move into the app. Because every line is public and the app can’t reach the network, you don’t have to take his word for any of it.

What Libreon Actually Does

Three engines cover the whole job. Office documents go through LibreOffice, PDF through PDFium, and text through a custom editor. Each one is worth understanding on its own terms.

Office documents open, edit and save in the formats people actually exchange. Word, Excel and PowerPoint in the modern OOXML set, docx, xlsx and pptx, plus the legacy binary set, doc, xls and ppt. OpenDocument in all six flavours, odt, ods and odp plus flat fodt, fods and fodp, and RTF. Apple iWork files, Pages, Numbers and Keynote, open read only through the libetonyek import filters the engine already carried. Find in document with match counts works across Office files through the front end search service, with next and previous moving the selection, and Word documents get a live word count line under the page from Writer own counter.

PDF covers the daily document grind that never needed a word processor. Smooth viewing with pinch zoom, page thumbnails and text search. Real AcroForm filling with text fields, checkboxes, radio buttons and dropdowns written as genuine field values with regenerated appearance streams, so Adobe Reader and every other viewer shows them. Flat forms with no fields get a Fill tool that free places text plus check and cross marks, the WPS pattern, committed as FreeText and stamp annotations. Signing uses drawn or imported signatures stored only on the device, placed in a resizable movable box, and flattened into page content by default with keep as annotation available as an option. Highlighting works the way readers expect. Long press a word, drag the handles, pick one of four colours. Highlights are standard Highlight annotations with quad points and the text in Contents, so other PDF apps display them and they survive saving and tab recovery. Copy selected text with a word count in the bar, and count words for the whole document from its text layer.

Text handles the files other office apps refuse to touch. Plain text, Markdown with a locked down no JavaScript preview, CSV with a read only table view plus open as spreadsheet handoff to the Office engine, JSON with pretty print validation, XML, logs, INI and CONF, YAML, subtitles and config files, basically any text MIME. Files up to 2 MB open editable. Between 2 and 50 MB they open read only in a virtualised line list. Above 50 MB the app offers read only head and tail views. Encoding, byte order mark and line endings round trip byte exactly, with BOM first, then strict UTF-8, then a small built in heuristic for UTF-16 without BOM, East Asian multibyte, Windows 1252 and ISO 8859-1. Find and replace, go to line, a live Ln Col word and character status line, word wrap and monospace toggles, and one shared word counting rule with JVM tests that counts Chinese and Japanese characters one each.

Everywhere features tie the three engines together. Tabs keep many documents open at once, with hot sessions holding a loaded engine and parked sessions saving a recovery copy and unloading under a memory budget, one live Office document, up to three live PDFs, unlimited small text buffers. If Android closes the app in the background, unsaved changes are still there when you come back, with a restore banner when the recovery copy is newer than the source. Search on the home screen filters open, recent and recently closed files by name. Light, dark and follow the system themes apply across app, Markdown preview and Office pages live, with a per document light pages option while the app stays dark. A themed launcher icon follows the wallpaper, and screen reader labels cover buttons, tabs, rows and toggles.

Privacy as Architecture, Not a Toggle

Most privacy apps ask you to trust a switch. Libreon asks you to read a manifest, because the guarantee is structural.

No internet permission is the headline, but the surrounding decisions are what make it hold. No accounts, no analytics, no crash reporters, no Play Services, no Firebase. Gradle dependency verification plus an allowlist enforces that nothing network capable sneaks in through a transitive dependency. Settings and signatures live in app private storage with cloud backup excluded, so signatures never ride a backup to a server. Saving writes to a private temp file, fsyncs, streams to the Storage Access Framework URI, verifies the byte count, and only then drops the temp copy. Before overwriting, the app compares the provider size and modification time against a stored fingerprint, and asks before clobbering a file another app changed meanwhile. If you open a file from a share intent with only a transient grant, edits go to the private copy and Save becomes Save as, which is the honest behaviour instead of silently losing work.

The support model follows the same ethic. Libreon is free and the author states it always will be, no ads, no subscriptions, no premium tier, no nagging. The single buy me a coffee banner lives at the very bottom of Settings, added in beta 4, with no popups, no reminders, no held back features. A report a problem link in the same screen opens GitHub Issues in your browser. Ignoring both is completely fine, and the author says so in the README.

For hams this maps directly onto familiar threat models. A club membership spreadsheet with phone numbers, an EmComm deployment roster, an equipment loan ledger, scanned QSL cards with home addresses. These are documents that should never transit a third party server just to be viewed on your own phone. An app that can’t reach the network can’t leak them, can’t train on them, can’t hold them hostage behind a login wall during an outage.

Under the Hood: LibreOfficeKit, PDFium and a Two Process Trick

The architecture document in the repository is unusually candid, and it repays reading, because it explains why Libreon exists in this exact shape and why nobody else built it this way sooner.

Office editing reuses LibreOffice core through LibreOfficeKit, with the Collabora Online browser front end running locally in a WebView. Assets load from the WebViewAssetLoader path, JavaScript talks to native code through a WebMessagePort bridge the project wrote itself, and every other network request is rejected in shouldInterceptRequest. Each Office document runs in its own engine process shown in the app through a shared surface, so a heavy document can’t take the app down. This two process design, option 2 of three considered in the architecture record, was chosen after the team confirmed that on Android each document kit runs LibreOffice main loop itself, so closing a document ends the process. Upstream Collabora Android glue assumes one document per process with its own Activity. Libreon instead hosts OfficeService in a dedicated office process and renders it into the main window through SurfaceControlViewHost, keeping the shared tab bar unchanged. Office to PDF switches detach the surface and keep engine state. Office to Office switches start a fresh engine process in about 2 seconds. The app process itself never dies when an engine crashes. It shows the engine stopped unexpectedly with a Reload button that reopens from the recovery copy.

The build cost explains the 115 MB download. Cross compiling LibreOffice core needs a Linux host with WSL2, tens of gigabytes of disk and about three hours per ABI on 12 cores, plus the Collabora online repository for the front end and Android glue. The team slimmed the engine from 204 MB stripped to 158 MB through feature disables, Os optimisation and compact RELR relocations, compressed the native libraries in the APK, and ships per ABI splits, 115 MB for arm64 and 118 MB for x86_64. The 33 MB ICU locale file is the next trimming candidate. Building without a signing key falls back to the debug key, and releases are signed with a private key kept outside the repository.

PDF takes the opposite path, small and hand built. PDFium from the Chromium 8100 prebuilt plus about fifteen hundred lines of new JNI, one engine for view, fill, sign and save. Tile based rendering into bitmaps with a low resolution pass then high resolution tiles, an LRU cache under the memory budget, all PDFium calls on one dedicated thread per document because PDFium isn’t thread safe. Save uses FPDF SaveAsCopy, incremental when not flattening, always save as new file by default for signed documents. The team fuzzed the JNI, fixed freed page handoffs and unchecked allocations found in a cross model review, and re verified output with pypdf, field values present, flattened signatures in page content, annotation only adding exactly one Stamp, original bytes untouched.

Text is the smallest engine and the most opinionated. Compose BasicTextField with the state based TextFieldState API for built in undo and streaming line indexing for very large files, commonmark-java for Markdown, a home grown RFC 4180 parser for CSV, org.json from the platform for JSON formatting. Markdown preview renders through commonmark-java with GFM tables into HTML shown in a WebView with JavaScript disabled and all network loads blocked. The whole text milestone carries 25 JVM tests, PDF adds 21 more, Office adds 18 for socket framing and engine messages, 64 in total.

Tabs and storage complete the picture. A Room database holds the tab registry, view state per kind, dirty flags, recovery paths and source fingerprints. Recovery copies write after 2 seconds idle for text, every 60 seconds while dirty for Office, and as an edit log replay for PDF annotations. Storage uses the Storage Access Framework only, with persistable grants for picker results and private working copies for transient share intents. No storage permissions at all.

Installing Libreon in Five Minutes

Get the APK from the releases page at https://github.com/jainiakhil/Libreon/releases. Pick arm64-v8a for almost every phone and tablet, or x86_64 for emulators and some Chromebooks. Open the file and allow installing from your browser or file manager when Android asks. It requires Android 12 or newer, which matches minSdk 31, and the download is about 115 MB because a whole office engine lives inside.

First open unpacks engine files, about 2.7 seconds on the emulator, longer through ARM translation. Open a docx from your downloads through the system picker, grant the persistable URI permission, and edit. The Office page follows your theme automatically. Try the per document light pages option in the document menu if you read white page documents at night with the app in dark mode. Open a fillable PDF, tap a field, fill it, add your saved signature, and use save as new file so the original stays pristine. Open a huge log or CSV and flip on the table view. Kill the app from recents with unsaved edits, reopen it, and confirm the restore banner. That single test tells you more about the tab recovery design than any feature list.

Beta testers should read the known gaps before adopting it daily. Printing and exporting Office documents to other formats aren’t available yet. Copy and paste inside Office documents stays within that document. Apple iWork files are view only. A filled form field in a protected Word template can stay marked showing placeholder with grey styling, so Word may show typed text greyed out. Flattened signature text is Latin only in Helvetica. Photo import of signatures is untested on some devices. The first phone test on a Galaxy S24 Ultra already fixed a Samsung pointer tagging crash, Office text selection gestures, blank page recovery and back navigation, and betas 3 through 5 polished dialogs, support links and the close button behaviour. Bug reports with sample files are genuinely welcome through the in app link, and the contributing guide walks through the offline, no trackers, clean room rules every change must keep.

Libreon Against the Usual Suspects

The honest read: Microsoft still owns maximum fidelity because it owns the formats, Google owns real time collaboration, and WPS owns feature breadth per megabyte of installer. Libreon wins on trust, weight discipline for what it ships, and offline certainty. It’s the app you hand to a new ham with a de-Googled phone, install on a club tablet that lives in a go box, or keep on an exam session phone that mustn’t leak candidate data. Use the right tool per job, and let Libreon own the private everyday work.

Why Hams Should Care

Field paperwork is radio work, even though it never touches RF. A SOTA activator carries a printed summit reference, a POTA park map, an equipment checklist and a log backup. An EmComm volunteer carries ICS 213 message forms, a deployment roster, a frequency plan and a shelter inventory. A club trustee carries membership dues in a spreadsheet, a repeater site lease in PDF, and meeting minutes in Word. All of these arrive as Office and PDF files, all of them need edits on a phone with no signal, and none of them should require an account to open.

Practical patterns fall out naturally. Keep the go box tablet offline with Libreon, the activation pack in one folder, the ICS forms in another, the repeater cheat sheets in a third. Fill PDF forms at the checkpoint and sign them on glass. Log fuel, mileage and battery voltages into a spreadsheet that never syncs anywhere. Draft the club newsletter in Markdown on the phone, preview it offline, and paste the HTML later. Store drawn signatures only on the device and flatten them into signed copies with the original preserved. When the exercise ends, move files over USB or Bluetooth, the same sneakernet discipline packet radio taught us decades ago.

There is also an examination and training angle. Volunteer examiner sessions handle candidate identities, answer sheets and FCC or MCMC paperwork. A no network office app shrinks the data exposure surface to the device in the room. For clubs running licensing classes on donated phones with no data plans, a 115 MB sideload that works forever with no account beats a cloud suite that demands logins before the first lesson slide renders.

Sources and Further Reading

• Libreon repository: https://github.com/jainiakhil/Libreon
• Libreon releases, 0.9.0 beta 1 through beta 5: https://github.com/jainiakhil/Libreon/releases
• Libreon architecture proposal: https://github.com/jainiakhil/Libreon/blob/main/docs/architecture.md
• Libreon milestone log with device test results: https://github.com/jainiakhil/Libreon/blob/main/docs/milestones.md
• Libreon contributing guide: https://github.com/jainiakhil/Libreon/blob/main/CONTRIBUTING.md
• LibreOffice, The Document Foundation: https://www.libreoffice.org/
• Collabora Online: https://www.collaboraonline.com/
• PDFium project: https://pdfium.googlesource.com/pdfium/
• CommonMark Java Markdown library: https://github.com/commonmark/commonmark-java

73 de 9M2PJU