Sanitize PDF
Runs in your browserStrip the active and hidden parts out of a PDF in your browser. Nothing is uploaded. This removes embedded JavaScript, attached files, document metadata and link actions, and leaves the pages themselves untouched.
or drop them here, or paste
One file. It stays on your device.
A PDF is not only pages. The format allows a document to carry scripts that run when it opens, files attached inside it, actions bound to links and to page events, and a metadata block recording who made it and with what.
Everything happens inside this page. Your file is read by JavaScript running on your own machine, and no part of it is sent anywhere.
Scripts, and why a document has them at all
Legitimate scripts exist: a form that adds up a column, a field that checks a date is valid. They are also the oldest attack surface in the format, which is why the security guidance for years has been to disable JavaScript in PDF readers entirely.
This tool removes document-level scripts, the OpenAction that runs the moment a file is opened, and the additional-actions entries bound to the document and to individual pages. A form that relied on scripting will stop calculating. A form that is just fields to type in will keep working.
Attachments
PDFs can contain other files. Often that is deliberate and useful, such as a spreadsheet attached to the report built from it. Sometimes it is accidental, and a document leaves an organisation carrying a working file nobody meant to send.
Removing embedded files strips those out. The pages do not change, because an attachment is not part of any page.
Metadata is the one that catches people
Every PDF records what produced it, and usually who. Export a document from Word and it carries the author name from that copy of Office. Export from InDesign and it carries the file path it was built from, which frequently contains a person's name and the internal name of a project.
Clearing the metadata removes the document information block and the XMP metadata stream. It does not touch anything visible on the pages, so a name printed in a footer stays printed in the footer. Metadata is what is written about the document, not what is written in it.
What this is not
It is not redaction. Nothing on a page is removed or covered, so text you can see and select is still there afterwards.
It is also not a virus scanner. It removes the categories of active content described above, which is the sensible precaution before passing an unfamiliar PDF around, but it makes no claim to detect anything malicious.
How to sanitize pdf
- 01
Add your PDF
Select or drop the file you want cleaned.
- 02
Choose what to strip
Scripts, attachments, metadata and link actions.
- 03
Clean
Press Clean PDF and download the stripped file.
Questions about Sanitize PDF
What does sanitizing a PDF remove?
Embedded JavaScript, the actions that run when the document opens, attached files, link actions and the metadata recording who and what produced the file. The pages themselves are unchanged.
Will my form still work afterwards?
Fields you type into keep working. Anything that calculated a value or validated an entry with a script will stop, because those scripts are exactly what is being removed.
Does this remove text from the pages?
No. Nothing visible is touched. That is redaction, which is a different tool.
Is this a virus scan?
No. It removes the categories of active content that a PDF can carry, which is a sensible precaution, but it does not detect or identify anything malicious.