Loading Techie Utils…

Sanitize PDF

Strip scripts, actions, attachments and metadata. Free, and runs entirely in your browser — nothing you enter is uploaded, stored or sent to a server.

About Sanitize PDF

A PDF is a program as much as a document. It can run JavaScript when it opens, launch a file when a page is turned, submit a form to a server, and carry whole other files inside itself. None of that is visible on any page, and all of it travels with the file.

Run it with nothing selected first. The report says what the document is actually carrying — how many scripts, how many active actions, how many embedded files — and that is usually more informative than the cleanup itself. Most documents carry nothing; a document that carries a script is either a real form or something worth being careful with.

What this does not do is make an untrusted PDF safe. The dangerous cases in the wild are usually not the script but a malformed font, image or filter that attacks a flaw in the reader itself, and no amount of removing objects touches that. Rasterising the document — turning every page into a picture — is the only approach that does, and it costs the text.

Where it helps

  • Counts what is there before anything is removed, which is the most useful thing it does.
  • Removes by kind, so a legitimate form can keep its fields while the metadata goes.
  • Handles the places scripts actually hide: the name tree, the open action, per-page and per-annotation actions, and XFA.
  • Flattens forms rather than deleting them, so answers survive.
  • Pages are untouched — nothing is rasterised and no quality is lost.
  • The document never leaves your browser, which for a suspicious file matters.

Limits

  • This is not a malware scanner. A PDF that attacks a reader through a malformed font or image is unaffected by removing objects.
  • Removing an action can break a legitimate interactive document: a form that submitted to a server will no longer submit.
  • Metadata removal covers the document information dictionary and the XMP packet, not every custom key a workflow might have added.
  • Digital signatures do not survive a rewrite of the document.
  • Password-protected files must be unlocked first.

Frequently asked questions

Does this make a suspicious PDF safe to open?

No, and it would be dangerous to treat it that way. It removes the active parts a PDF is *allowed* to have. The exploits that matter usually target the reader's own parsing of fonts, images and filters — which are still there. For a genuinely untrusted file, open it in a sandboxed viewer, or rasterise it.

Why would a normal document contain JavaScript?

Forms, mostly: field validation, calculated totals, and date formatting are all done in script. That is legitimate and common, which is exactly why the presence of a script is not by itself a verdict.

What is an "active action"?

Anything that does something other than move you around the document: launching a file, submitting a form, importing data, or opening another document. Ordinary internal links and destinations are not touched.

Will removing metadata remove everything identifying?

It removes the obvious layers — the document information dictionary and the XMP packet. Annotation authors, embedded file names and text in the content itself are separate; the Metadata and Annotations tools cover those.

Related tools

More Images & Files tools