Tools / Sanitise PDF
Sanitise a PDF
Strips the scripts, the hidden files and the actions that fire on open.
- Your file is uploaded to do this
- Deleted 24 hours after processing
- What we do with it
Choose a PDF
or drop them here
How it works
- Add the PDF.
- Choose whether to clear the document properties as well.
- Download the cleaned file. It tells you what it found.
What a PDF can carry besides the document
A PDF can hold scripts, embedded files, external actions and things that fire the moment it is opened, none of which are part of the page you read.
Sanitise anything that arrived unexpectedly
Particularly a PDF attached to an email you were not waiting for.
It reports what it found
Worth reading. A document with an action that runs on open is telling you something about where it came from.
Clear the document properties at the same time
Author, producer and dates travel with the file and are rarely worth passing on.
Sanitise before forwarding, not after
The point is to avoid passing something on, which only works if you do it first.
Where this is the wrong tool. This uploads. The file is sent over an encrypted connection, cleaned on our servers and deleted after 24 hours. Removing active content is not a virus scan, and a PDF that you have reason to distrust is best not opened at all.
When the browser is not enough
Scanly for Android
Take document-scanning workflows to your Android phone with Scanly. See the Google Play listing for current features, requirements and data-processing information.
Questions
What can actually be hidden in a PDF?
JavaScript that runs when the file opens; other files embedded whole inside it; automatic actions attached to the document or to individual pages; annotations whose purpose is to launch a program or fetch a remote document; and XFA form code. None of that is needed to display a page, and all of it has been used to attack people.
Will it change how the document looks?
No. The pages are copied through untouched. What is removed is the machinery around them, so the file opens and reads exactly as before.
Do my links still work?
Ordinary links do, yes. A link rectangle is kept and stays clickable if it points at a web address. What is removed is the kind of action that launches a program on your machine or pulls in a remote file, which is not what a reader expects a link to do.
It says nothing was removed. Was it broken?
No. That file simply carried none of these things, which is true of most PDFs. The download has still been rewritten cleanly, so it is safe to use, but the original was already fine.
Does my file leave my device?
Yes. The cleaning is done by qpdf, which is not something a browser has. The file is uploaded, cleaned and deleted 24 hours later.