净化 PDF
移除 JavaScript、嵌入文件和打开时运行的动作。
这款工具完全在你的浏览器中运行。文件从不上传，你可以在浏览器的网络标签中亲自验证这一点。 亲自验证：打开浏览器的网络标签观察。你会看到一个查询你是否还有剩余任务的小请求，只包含工具名称和一段哈希，绝不会包含文件。
这款工具的作用
A PDF is not a static document. It can carry JavaScript, run an action the moment it is opened, hold other files inside itself, and send a reader out to a URL. Those features have legitimate uses, and they are also why PDFs are a common malware carrier. This tool rebuilds the document from its pages alone, which leaves every document-level hook behind.
Use it on anything that arrived unexpectedly and has to be read anyway: an invoice from an address you do not recognise, a CV from a job board, a form downloaded from a site you have no reason to trust. It is also worth running on files you distribute, so nobody has to wonder whether the attachment inside yours is meant to be there.
工作原理
- Drop the PDF onto this page.
- Leave the three main switches on. JavaScript, embedded files and open actions are all served by one rebuild, and together they cover nearly everything active a PDF can carry.
- Turn on Remove external links if the file came from a source you do not trust, since a link is a phishing vector even when nothing else in the file is.
- Turn on Strip metadata under advanced options if you also want the author and timestamps gone.
- Press Sanitize. The result reports the page count and how many embedded files were removed.
The removal works by not copying rather than by deleting. The document is rebuilt into an empty file with only its pages carried over, so document-level JavaScript, the name tree of embedded files, the action that fires on open and the rest are never brought across at all. That is more reliable than hunting through a file for each hook: you cannot forget to remove something you never copied.
Because it is one rebuild, the first three switches are effectively one decision. Turning any of them on rebuilds the document, and the rebuild leaves all of them behind. They are separate controls because they name separate worries, not because you can keep the JavaScript and lose the attachments.
The rebuild is thorough enough to cost you things you may want. Document-level structure is exactly what is discarded, so the interactive form dictionary, the outline and anything else attached to the document rather than to a page does not survive. A fillable form comes out as pages that look right and no longer fill in. That is why you should sanitise files you receive rather than files you are still working on.
A file attached as a page annotation is not in the name tree, so the rebuild alone would leave it in place. Attachments are counted before the rebuild and removed by name afterwards, which catches both kinds. The number in the result is what was actually found, so a report of zero embedded files is information rather than a shrug.
This runs entirely in your browser on qpdf compiled to WebAssembly. For a file you already suspect, that is the right shape: the document is never handed to a third party, and it is never opened by a full PDF reader with scripting enabled - qpdf parses the structure without executing anything in it.
这款工具做不到的事
- This is not antivirus software. It removes the categories of active content a PDF can hold; it does not scan for or identify malware, and it cannot tell you whether a file was hostile.
- The rebuild discards document-level structure, so a fillable form stops being fillable and the outline is not carried over.
常见问题
- PDF 里的主动内容指什么？
- 阅读器可能自动运行的文档级 JavaScript；文件一打开就触发的 OpenAction，以及翻页和表单事件上对应的触发器；嵌入在 PDF 内部的文件；还有指向某个 URL 的链接或动作。这些都是正当功能，同时也是 PDF 被当作投递工具时的常规入口。
- 这能清掉 PDF 里的病毒吗？
- 它移除的是 PDF 里能携带并启动病毒的那些部分，这和扫描恶意软件不是一回事，也不该这么理解。如果你确有理由认为某个文件带有恶意，不要打开它——用杀毒软件，或者通过你信任的渠道向发件人核实。净化减少的是文档能做的事，而不是给它下安全结论。
- 之后可能有什么会失效？
- 任何依赖文档而非页面的东西。可填表单不再接受输入，书签大纲不会保留，嵌入的附件会消失，用 JavaScript 计算合计的表单只会显示最后一次保存的值。页面内容、文字和图像都不变。
- 外部链接也该一起移除吗？
- 默认关闭，因为多数文档里的多数链接是需要的，从你自己要读的报告里删掉它们很麻烦。对于来自你不信任来源的文件，请打开它：一个看着像熟悉银行、却指向别处的链接是文件里最老的把戏，移除所有链接虽然粗暴但很彻底。
- 可疑文件会被上传到什么地方吗？
- 不会。qpdf 以 WebAssembly 的形式运行在你浏览器的 Web Worker 里，它只解析文件的结构，不执行其中的任何东西。一个你已经不信任的文件既不会到达服务器，途中也不会被交给能执行脚本的阅读器。