Sanitize PDF
Remove JavaScript, embedded files and actions that run on open.
This tool runs entirely in your browser. Your file is never uploaded, and you can verify that in your browser's network tab. Verify it yourself: open your browser's network tab and watch. You will see one small request asking whether you have tasks left - a tool name and a hash, never the file.
What this does
A PDF is not a static document. It can carry JavaScript, run an action the moment it is opened, hold other files inside itself, and send a reader out to a URL. Those features have legitimate uses, and they are also why PDFs are a common malware carrier. This tool rebuilds the document from its pages alone, which leaves every document-level hook behind.
Use it on anything that arrived unexpectedly and has to be read anyway: an invoice from an address you do not recognise, a CV from a job board, a form downloaded from a site you have no reason to trust. It is also worth running on files you distribute, so nobody has to wonder whether the attachment inside yours is meant to be there.
How it works
- Drop the PDF onto this page.
- Leave the three main switches on. JavaScript, embedded files and open actions are all served by one rebuild, and together they cover nearly everything active a PDF can carry.
- Turn on Remove external links if the file came from a source you do not trust, since a link is a phishing vector even when nothing else in the file is.
- Turn on Strip metadata under advanced options if you also want the author and timestamps gone.
- Press Sanitize. The result reports the page count and how many embedded files were removed.
The removal works by not copying rather than by deleting. The document is rebuilt into an empty file with only its pages carried over, so document-level JavaScript, the name tree of embedded files, the action that fires on open and the rest are never brought across at all. That is more reliable than hunting through a file for each hook: you cannot forget to remove something you never copied.
Because it is one rebuild, the first three switches are effectively one decision. Turning any of them on rebuilds the document, and the rebuild leaves all of them behind. They are separate controls because they name separate worries, not because you can keep the JavaScript and lose the attachments.
The rebuild is thorough enough to cost you things you may want. Document-level structure is exactly what is discarded, so the interactive form dictionary, the outline and anything else attached to the document rather than to a page does not survive. A fillable form comes out as pages that look right and no longer fill in. That is why you should sanitise files you receive rather than files you are still working on.
A file attached as a page annotation is not in the name tree, so the rebuild alone would leave it in place. Attachments are counted before the rebuild and removed by name afterwards, which catches both kinds. The number in the result is what was actually found, so a report of zero embedded files is information rather than a shrug.
This runs entirely in your browser on qpdf compiled to WebAssembly. For a file you already suspect, that is the right shape: the document is never handed to a third party, and it is never opened by a full PDF reader with scripting enabled - qpdf parses the structure without executing anything in it.
What this tool cannot do
- This is not antivirus software. It removes the categories of active content a PDF can hold; it does not scan for or identify malware, and it cannot tell you whether a file was hostile.
- The rebuild discards document-level structure, so a fillable form stops being fillable and the outline is not carried over.
Questions people ask
- What counts as active content in a PDF?
- Document-level JavaScript, which a reader may run automatically; an OpenAction that fires the moment the file is opened, along with the equivalent triggers on page changes and form events; files embedded inside the PDF; and links or actions that reach out to a URL. All of these are legitimate features that are also the standard ways a PDF is used as a delivery mechanism.
- Does this remove a virus from a PDF?
- It removes the parts of a PDF that can carry and launch one, which is not the same as scanning for malware and should not be treated as such. If you have real reason to think a file is hostile, do not open it - use antivirus software, or ask the sender through a channel you trust. Sanitising reduces what a document can do; it is not a verdict on it.
- What might stop working afterwards?
- Anything that depends on the document rather than on a page. A fillable form stops accepting input, the bookmark outline is not carried over, embedded attachments are gone, and a form that calculated totals with JavaScript shows only its last saved values. Page content, text and images are unchanged.
- Should I remove external links too?
- It is off by default because most links in most documents are wanted, and stripping them from a report you are reading yourself is a nuisance. Turn it on for a file from a source you do not trust: a link that looks like a familiar bank and points somewhere else is the oldest trick in the file, and removing every link is a blunt but complete answer to it.
- Is the suspicious file uploaded anywhere?
- No. qpdf runs as WebAssembly in a Web Worker in your browser, and it parses the file's structure without executing anything inside it. A file you already distrust never reaches a server, and it is never handed to a scripting-enabled reader on the way.