Why is JavaScript in a PDF a risk?

The PDF format lets documents run JavaScript when they open, when pages change or when forms are clicked or filled, and lets them launch programs or submit data to web addresses. These features are used for tracking, phishing and exploiting reader bugs. After sanitizing, the document contains no scripts or auto actions, only static content.

Does sanitizing change what the pages look like?

No. Only the scripts, actions, links, comments, form fields, attachments and metadata you select are removed. Text, images, vector graphics and layout stay the same, and text remains selectable and searchable.

Why is the digital signature invalid after cleaning?

Any change to a signed PDF breaks its signature; that is how signatures detect tampering. The tool warns you when it finds signature fields, so don’t sanitize files whose signatures must stay valid.

Are my files uploaded?

No. Scanning and cleaning both happen in your browser with no network upload, so suspicious files never leave your computer.

🧼

🧼Sanitize PDF - Remove JavaScript, Links & Hidden Metadata

A PDF from an unknown source may carry JavaScript, actions that run as soon as it opens, commands that launch external programs or links that quietly call home; and a PDF you are about to send may reveal author names, company names, editing software, revision history, comments and attachments. After you upload a file, this tool scans it and lists JavaScript (with the code viewable), auto actions (document open and close, page, mouse and form events), launch actions, form submission, data import and other risky actions, multimedia and 3D active content, XFA forms, external links (with their addresses), comments, form fields, attachments, Info and XMP metadata, page thumbnails and private data written by Illustrator or Photoshop. Tick what you want removed: scripts and auto actions, attachments, metadata and private data are selected by default, while links, comments and forms are up to you. The file is rewritten from scratch, so earlier revisions left by incremental saves and unreferenced orphan objects disappear too, and the output is scanned again to show a before-and-after comparison. The text, images and layout of the pages stay unchanged. Everything runs locally in your browser, so suspicious files never leave your computer.

Free · No sign-up · Runs in your browserLast updated: 2026-10-26

Loading tool...

How to use Sanitize PDF

1Upload the PDF to check; it is scanned automatically for scripts, actions, links, attachments and metadata
2Tick what to remove: scripts and auto actions, external links, comments, form fields, attachments, metadata and private data
3Click Sanitize & download, review the before/after report and save the clean PDF

FAQ

Why is JavaScript in a PDF a risk?: The PDF format lets documents run JavaScript when they open, when pages change or when forms are clicked or filled, and lets them launch programs or submit data to web addresses. These features are used for tracking, phishing and exploiting reader bugs. After sanitizing, the document contains no scripts or auto actions, only static content.
Does sanitizing change what the pages look like?: No. Only the scripts, actions, links, comments, form fields, attachments and metadata you select are removed. Text, images, vector graphics and layout stay the same, and text remains selectable and searchable.
Why is the digital signature invalid after cleaning?: Any change to a signed PDF breaks its signature; that is how signatures detect tampering. The tool warns you when it finds signature fields, so don’t sanitize files whose signatures must stay valid.
Are my files uploaded?: No. Scanning and cleaning both happen in your browser with no network upload, so suspicious files never leave your computer.