See what a PDF from an unknown sender can run, remove it, then read the saved copy back to prove it is clean.
PDF Sanitizer
See what a PDF from an unknown sender can run, remove it, then read the saved copy back to prove it is clean.
A document you do not trust is read, stripped and re-checked inside this tab, never opened by a reader and never sent anywhere. Scripts are examined as text and are never executed.
A PDF is a small program as much as a page. It can hold a script that runs the instant the document opens, an action that starts another program on the machine, a button that posts a filled form to an address of the author's choosing, an entire executable embedded as an attachment, and an XML form layer with scripting of its own. Every place an action can sit is visited here — the open action, the document, page, annotation and form-field triggers, bookmarks, the document-level script tree — and chains are followed to the end, so a harmless first step with a launch action queued behind it is still caught. Each finding says where it lives, what it points at, and whether it needs a click. Choose what goes, and the rewritten copy is read back from its own bytes and scanned again.
Features
Ten categories graded high, medium and low, with high and medium ticked to begin with
Every finding shows where it sits, what it targets and whether it runs without a click
Action chains are followed through, so nothing hides behind an innocent first step
Embedded files named like programs are listed apart from ordinary attachments
A raw keyword pass over the file's bytes that decodes names disguised with #xx escapes
The cleaned copy is reloaded and scanned again, and marked clean only when nothing is left
Several PDFs at once, downloaded one by one or together as a ZIP
Warnings for what each removal changes, such as a form that stops calculating
How to use the PDF Sanitizer
Drop in one or more PDFs; each is read and scanned on arrival
Work through the findings, and open the raw keyword counts if you want the second opinion
Untick anything you need to keep — web links and metadata start unticked
Sanitize, read the re-scan, and download the cleaned copies
Example
Input
invoice_urgent.pdf — unexpected, from a sender nobody recognises
Output
6 findings: 2 scripts that run on opening, 1 launch action, 1 attachment named invoice.pdf.exe, 1 web link, document information · after sanitizing, the re-scan is clean
Both scripts ran the moment the document opened, without anything being clicked.
Common errors & troubleshooting
The form stopped adding up after sanitizing. — Its totals were worked out by script, and the scripts have gone. Run it again with JavaScript unticked if you genuinely need the arithmetic, knowing that is the one category most often used to carry an attack.
An encrypted PDF was scanned but never cleaned. — A password-protected file cannot be rewritten until it is opened. Remove the password with Decrypt PDF first, then bring the result back here.
The keyword table lists names the findings do not. — They answer different questions. The keyword pass counts names in the raw bytes, including ones in objects nothing points at; the findings are only what the document actually reaches.
The form now shows a “Please wait…” page and nothing else. — The whole form lived in the XFA layer and the ordinary pages were only that placeholder. Keep the XFA layer if you must fill the form in — and be careful with it, because it carries scripting too.
Frequently asked questions
What counts as active content in a PDF?
Anything that does something rather than shows something: scripts, triggers that fire on opening, closing, saving or printing, actions that launch a program or submit a form, links that open another file, embedded files, an XFA form layer, and rich media or 3D objects.
Can a PDF really run something the moment I open it?
It can try. An open action and the document and page triggers all fire with no click at all, and those are counted separately here for that reason. Whether a reader obeys depends on its settings, but the instruction is in the file either way.
Will removing JavaScript break the form in the document?
It can. Scripts are what calculate totals, format dates and numbers, and check what you typed, so all of that stops. The fields themselves and anything already filled in are untouched, and that trade-off is spelled out before you commit.
How can I tell the cleaned copy is genuinely clean?
Because it is not taken on trust. The rewritten bytes are loaded again as a fresh document and scanned from scratch, and only a file whose second scan finds nothing is marked clean. The numbers you see are that second reading.
Why is an attachment named .exe treated differently from other attachments?
Because opening it runs code, which no spreadsheet or image does. Anything ending in an extension that executes — .exe, .js, .bat, .ps1, .vbs and a couple of dozen more — is graded high rather than medium and listed on its own.
Does sanitizing change how the pages look?
No. Page content is not touched, so text, artwork and layout come through unchanged. What disappears is behaviour: multimedia players and links left with nothing to do are dropped, and metadata goes only if you ask.
Related tools
PDF Privacy Scanner — Find the metadata and personal data hiding inside a PDF.
PDF Attachments — List, extract, add or remove the files embedded inside a PDF.
PDF Inspector — See a PDF’s version, page sizes, fonts, images, forms, security and standards claims.
Remove PDF Annotations — Strip comments, highlights, drawings and stamps from a PDF, keeping links if you like.
PDF Metadata Editor — View, edit or strip a PDF’s title, author, subject, keywords and producer.
Decrypt PDF — Remove password protection from an encrypted PDF.
Flatten PDF — Lock filled form fields into the page so a PDF looks the same everywhere.
File Hash Checksum — Compute MD5, SHA-1, SHA-256 and SHA-512 checksums of files and compare against an expected hash.
More Security tools
JWT Decoder — Decode JWT header & payload and inspect exp / iat (no verification).
Hash Generator — SHA-256 / SHA-1 / SHA-384 / SHA-512 via the Web Crypto API.
Password Generator — Generate strong, random passwords with a strength meter (crypto-secure).
SSH Key Generator — Generate Ed25519, RSA or ECDSA SSH keypairs in your browser and download the public and private keys.
PPK ↔ PEM Converter — Convert SSH private keys between PuTTY .ppk and OpenSSH/PEM (RSA & Ed25519) — locally in your browser.
TOTP / 2FA Generator — Generate time-based one-time passwords (2FA codes) from a base32 secret.
JWT Signer — Create and sign a JWT (HS256/384/512) from a payload and secret — Web Crypto.
Basic Auth Generator — Generate and decode HTTP Basic Auth Authorization headers from a username and password.
Certificate & Private Key Matcher — Confirm an X.509 certificate or CSR and a private key belong together (the classic modulus mismatch check) — locally in your browser.
PFX to PEM Extractor — Open a password-protected .pfx/.p12 file and split it into certificate, chain, and private-key PEM blocks.
Bcrypt Generator — Hash a password with bcrypt and verify a password against a bcrypt hash, in your browser.
HMAC Generator — Generate an HMAC (SHA-256, SHA-1, SHA-512) from a message and secret key using Web Crypto.
Password Strength Checker — Check password strength with entropy, character-set and common-pattern analysis, in your browser.
X.509 Certificate Decoder — Decode a PEM or DER certificate to view subject, issuer, validity, SANs and fingerprints.
Diceware Passphrase Generator — Generate a memorable, high-entropy passphrase from the EFF word list, in your browser.
CSP Analyzer — Parse a Content-Security-Policy header into a directive table with warnings and explanations.
File Hash Checksum — Compute MD5, SHA-1, SHA-256 and SHA-512 checksums of files and compare against an expected hash.
IBAN Generator & Validator — Generate valid test IBANs by country and validate any IBAN with MOD-97 check digits.
AES Encrypt / Decrypt — Encrypt and decrypt text with AES-GCM and a passphrase, using Web Crypto in your browser.