On This Page

Apache Tika is an open-source Java library that detects and extracts text and metadata from over 1,000 file types through a single API. Feed it a PDF, DOCX, XLS, or MSG file and get back plain text plus structured metadata. No format-specific code required.

This guide covers installation, basic parsing, custom parsers, server deployment, and the two things you need to act on immediately: a critical security patch and the 4.x migration breaking changes.

CVE-2025-66516 (CVSS 10.0): Patch before processing untrusted PDFs. An XXE injection flaw in tika-core versions 1.13 through 3.2.1 lets a crafted PDF trigger file disclosure, SSRF, or denial of service with no authentication required. The flaw is in tika-core itself, not only the PDF parser module, so patching only the PDF module leaves you exposed. Upgrade to tika-core 3.2.2 or later. Where immediate upgrade is not possible, disable the PDF parser via tika-config.xml and pre-screen PDFs with pdfid.py or qpdf to reject documents containing /AcroForm or XFA references. Source: Upwind.io advisory, December 2025.

Prerequisites: Java 17 and Maven 3. Tika 2.x reached end of life in April 2025; Java 8 is no longer supported. If you are on Tika 2.x, you face both the security patch and the version migration simultaneously.


Installation

Use the Bill of Materials (BOM) artifact to keep module versions aligned. Do not pin individual artifact versions manually.

Maven:

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.apache.tika</groupId>
      <artifactId>tika-bom</artifactId>
      <version>3.2.3</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

<dependencies>
  <dependency>
    <groupId>org.apache.tika</groupId>
    <artifactId>tika-parsers-standard-package</artifactId>
  </dependency>
</dependencies>

Gradle:

dependencies {
    implementation(platform("org.apache.tika:tika-bom:3.2.3"))
    implementation("org.apache.tika:tika-parsers-standard-package")
}

Build from source with mvn -Pfast install to skip tests and checkstyle. The Maven Daemon (mvnd) with -T1C parallel builds gives 2-3x faster rebuild times during development.


Basic parsing

The Tika facade handles format detection and routes each document to the correct parser automatically.

Extract plain text:

import org.apache.tika.Tika;

Tika tika = new Tika();
try (InputStream stream = new FileInputStream("document.pdf")) {
    String text = tika.parseToString(stream);
}

Extract text and metadata together:

import org.apache.tika.parser.AutoDetectParser;
import org.apache.tika.sax.BodyContentHandler;
import org.apache.tika.metadata.Metadata;

AutoDetectParser parser = new AutoDetectParser();
BodyContentHandler handler = new BodyContentHandler();
Metadata metadata = new Metadata();

try (InputStream stream = new FileInputStream("document.pdf")) {
    parser.parse(stream, handler, metadata);
    String text = handler.toString();
    String author = metadata.get("Author");
}

Command line:

java -jar tika-app-*.jar --text document.pdf
java -jar tika-app-*.jar --metadata document.pdf
java -jar tika-app-*.jar --detect document.pdf

Expected output for --detect on a PDF: application/pdf. For --metadata, you get key-value pairs including Content-Type, Author, Creation-Date, and format-specific fields.

XHTML output (preserves document structure for downstream processing):

import org.apache.tika.sax.ToXMLContentHandler;

ContentHandler handler = new ToXMLContentHandler();
AutoDetectParser parser = new AutoDetectParser();
Metadata metadata = new Metadata();

try (InputStream stream = new FileInputStream("document.pdf")) {
    parser.parse(stream, handler, metadata);
    String xhtml = handler.toString();
}

Custom parsers

Tika's parser guide describes a five-minute workflow for adding support for a new file type. Extend AbstractParser, declare your MIME type, and register the class.

public class CustomParser extends AbstractParser {
    private static final Set<MediaType> SUPPORTED_TYPES =
        Collections.singleton(MediaType.application("custom-format"));

    public Set<MediaType> getSupportedTypes(ParseContext context) {
        return SUPPORTED_TYPES;
    }

    public void parse(InputStream stream, ContentHandler handler,
                     Metadata metadata, ParseContext context)
                     throws IOException, SAXException, TikaException {

        metadata.set(Metadata.CONTENT_TYPE, "application/custom-format");
        XHTMLContentHandler xhtml = new XHTMLContentHandler(handler, metadata);
        xhtml.startDocument();
        // your parsing logic
        xhtml.endDocument();
    }
}

Register by adding the fully qualified class name to META-INF/services/org.apache.tika.parser.Parser. AutoDetectParser picks it up automatically.


Server deployment

Tika Server exposes a REST API so non-Java applications can use Tika without embedding the library.

Docker:

FROM openjdk:17-jre-slim
COPY tika-server-standard-*.jar /opt/tika-server.jar
EXPOSE 9998
CMD ["java", "-jar", "/opt/tika-server.jar", "--host=0.0.0.0"]

Core endpoints:

Endpoint Method Returns
/tika POST Extracted text
/meta PUT Metadata as JSON/CSV/XMP
/detect/stream PUT MIME type string
/rmeta PUT Recursive metadata including embedded documents
/unpack PUT Embedded files as ZIP

HTTP response codes: 200 (success), 204 (success, empty result), 422 (unsupported MIME type or encrypted document), 500 (processing error).

By default, Tika 3.x forks child processes to isolate parser crashes. To disable forking: set <noFork>true</noFork> in configuration.

JVM tuning for production:

java -Xmx4g -Xms2g -XX:+UseG1GC -XX:MaxGCPauseMillis=200 \
     -jar tika-server-standard-*.jar

For high-throughput distributed pipelines, the tika-grpc module introduced in 3.x offers lower latency than the REST server. Evaluate it as the default transport for new pipeline builds rather than treating it as an advanced option.


Tika-pipes for batch processing

Tika-pipes handles asynchronous, batch document processing through a fetcher/emitter architecture. Wellcome Trust used it to process millions of grant PDFs; a key finding from their implementation: disable Tesseract's default multithreading to prevent resource contention in parallel workloads.

Available fetchers: FileSystem, HTTP, S3, GCS, Azure Blob, MSGraph. Emitters: FileSystem, S3, OpenSearch, Solr.

Security warning: tika-pipes combined with tika-server creates a significant attack surface. The /pipes endpoint requires enableUnsecureFeatures=true in configuration. Do not expose this to the internet. Restrict to tightly controlled internal networks.


Python and R integration

Both interfaces run Tika as a background REST server and require Java 17 on the host.

Python:

from tika import parser

parsed = parser.from_file('document.pdf')
content = parsed['content']
metadata = parsed['metadata']

R:

library(rtika)
text <- tika_text('document.pdf')
metadata <- tika_metadata('document.pdf')

Note: LanguageIdentifier is deprecated as of current releases. Use LanguageDetector web services instead. The Baeldung Tika tutorial (updated April 2026) still references the old class in some examples; treat those samples as outdated.


Tika 4.x: what changes and what breaks

Apache Tika 4.0.0-alpha-1 is available on Maven Central. It is alpha; do not use in production without testing. The architectural changes are significant enough to plan for now.

New modules:

  • tika-vlm: vision parsers for OpenAI-compatible APIs, Gemini, and Claude
  • tika-inference: text embeddings and CLIP image embeddings for semantic search
  • tika-async-cli: asynchronous command-line processing
  • tika-pipes-fork-parser: isolated parsing via fork mode

Breaking changes (per DeepWiki's May 2026 analysis):

  • Configuration format changes from XML to JSON via TikaJsonConfig. Every custom tika-config.xml must be rewritten.
  • tika-parsers-standard-package is now a POM artifact. Maven dependencies require <type>pom</type>.
  • Removed modules: tika-batch, tika-dl, tika-fuzzing, tika-pipes-solr, ExternalParser, DigestingParser.
  • tika-pipes implementation modules now use PF4J plugin architecture.

Teams running Solr-based document indexing pipelines will need to rewrite their integration layer. The removal of tika-batch affects any workflow using that module for parallel processing.

The Confluence wiki documents the project's tracking of open-source vision-language model candidates for potential core integration: ColPali (PDF embeddings from rendered images), DeepSeek-OCR-2, Qwen-VL, and MinerU. IBM's Docling is documented as an integration pattern for RAG workflows.


Common failure modes

OutOfMemoryError on large documents. Set explicit limits:

TikaConfig config = new TikaConfig.Builder()
    .setMaxStringLength(100 * 1024 * 1024)  // 100MB text limit
    .setMaxEmbeddedResources(50)
    .setMaxParseTime(60000)                  // 60-second timeout
    .build();

Use TikaInputStream for large files to enable streaming rather than loading the full document into memory.

Encrypted or password-protected documents return HTTP 422 from the server. Tika cannot decrypt; pre-process these files before sending them to the parser.

Parser conflicts occur when multiple parsers claim the same MIME type. Check your classpath for duplicate parser registrations. The AutoDetectParser picks the first match it finds, which may not be the one you want.

Dependency conflicts in complex projects. Always use the BOM artifact rather than pinning individual module versions. The Baeldung tutorial's reference to tika-parsers version 1.17 is outdated; following it without the BOM will produce version mismatches against current 3.x releases.


When to use something else

Tika is the right tool when you need broad format coverage, on-premise deployment, and open-source licensing. It is not the right tool for every case.

Use a managed cloud service like AWS Textract or Azure Document Intelligence when you need structured form extraction, table parsing with cell-level coordinates, or handwriting recognition. Tika extracts text; it does not understand document layout or field semantics.

For scanned documents where OCR quality is the primary concern, Tika delegates to Tesseract. If OCR accuracy is your bottleneck, evaluate dedicated OCR capabilities or a purpose-built IDP platform rather than tuning Tesseract through Tika.

For semantic search and document processing RAG pipelines, the 4.x tika-vlm and tika-inference modules are worth evaluating once they reach stable release. Until then, tools like Unstructured offer production-ready embedding pipelines today.


What practitioners report

Teams processing diverse document archives at scale report that Tika's format breadth is its primary advantage: one dependency handles formats that would otherwise require five separate libraries. The unified metadata schema across formats simplifies downstream processing.

The friction points practitioners consistently flag: memory management for large embedded documents requires explicit configuration or production deployments hit OOM errors; Tesseract integration requires disabling default multithreading in parallel workloads or throughput degrades; and the 4.x migration, combined with the security patch requirement, means teams on 2.x face a significant upgrade effort with no incremental path.

The CVE-2025-66516 correction from the earlier CVE-2025-54988 advisory catches teams that patched only the PDF parser module. Those deployments remain vulnerable until tika-core itself is upgraded to 3.2.2.