Check if a PDF is safe to open
Checking whether a PDF is safe to open means inspecting its internal structure for active content before any reader executes it. This page parses the file — it never runs or renders it — and reports embedded JavaScript, auto-run OpenActions, Launch actions, additional-action (/AA) triggers, XFA forms, embedded attachments, and every external link URL in the document, summarized as a severity verdict. A clean report means none of the known active-content markers are present; it is not a malware guarantee, since reader-specific exploits can hide in ordinary content. The scan runs entirely in your browser.
How it works
A PDF is a database of numbered objects — dictionaries, streams, arrays — and everything a malicious file can do is declared somewhere in those objects with well-known dictionary keys. The scanner reads your file as raw bytes, parses the object structure (including compressed object streams, where modern files hide most of their dictionaries), and walks it looking for those keys. Nothing is executed: no script runs, no action is followed, no page is rendered. Parsing a Launch action's dictionary reveals what command it would run without ever running it.
The checklist mirrors how PDF malware actually operates. /JavaScript and /JS entries hold embedded script — legitimate in interactive forms, but also the payload carrier in most malicious PDFs. /OpenAction in the document catalog is executed automatically by the reader the moment the file opens; a benign one jumps to a page, a hostile one fires the JavaScript. /AA (additional actions) attach triggers to other events — page becomes visible, field loses focus, document closes — giving script a way to run without even an open event. /Launch actions ask the reader to start an external program or open another file, which is why modern readers warn on them. /XFA marks an XML Forms Architecture form, a deprecated Adobe format with its own scripting engine and a history of parser exploits. /EmbeddedFile entries are attachments — a PDF can carry an executable inside it. Finally, every /URI link action is collected, so you can read the full list of external URLs the document points at and spot a lookalike phishing domain before anyone clicks it in print or on screen.
Findings are weighted into a verdict. Script wired to an auto-run trigger, or any Launch action, rates high; JavaScript present but only reachable through form interaction rates medium, as do XFA and attachments; external links alone rate informational, with the URLs listed for your own judgment. A file with none of these markers is reported clean — meaning free of known active-content features, not certified harmless, because exploits that target rendering bugs in a particular reader live in content the format considers ordinary.
The scan is read-only and changes nothing. If the report worries you, the follow-ups are on this site: view the pages in the sandboxed View as PDF viewer (which only draws content), strip scripts with Remove PDF JavaScript, or rebuild the file without any active content using Sanitize PDF.
Illustrative example: an unexpected "invoice" attachment
Illustrative scenario, not a recorded benchmark. File sizes, timings and results depend on the input and device. Try the reproducible samples.
An accountant receives Invoice_44821.pdf (312 KB, 2 pages) from an unfamiliar address and drops it into the scanner instead of opening it. The parse takes under a second and reports: 1 embedded JavaScript stream of 4.2 KB inside a compressed object stream; an /OpenAction in the catalog that points at that script; an /AA dictionary firing the same script again when page 1 becomes visible; no Launch action, no XFA, no attachments; and 2 external links — one to a genuine-looking bank domain and one to a lookalike domain with a transposed letter. Verdict: high risk. The script-plus-auto-run pairing means code was set to execute on open, and the transposed-letter URL marks the file as phishing; it is deleted and reported to IT.
For contrast, the same accountant scans a 1.4 MB tax form from a government site: the report shows JavaScript present in 14 form-field validation actions, no OpenAction, no Launch, no attachments, and 3 links to the agency's own domain. Verdict: medium, with the explanation that the script is only reachable through form interaction — consistent with a legitimate interactive form, so it is opened normally in an up-to-date reader.
Frequently asked questions
How can I check if a PDF is safe to open?
Scan it with a tool that parses the file's internal structure without executing anything, looking for the features malware actually uses: embedded JavaScript, actions that run automatically on open, launch commands, attachments, and suspicious links. This page performs that scan in your browser and gives a severity verdict with every finding listed.
Can this scanner itself trigger malware in the file?
No — the file is read as raw bytes and its object structure is parsed like data; no script is executed, no action is followed, and no page is even rendered. Parsing is to opening what reading a recipe is to eating the dish.
Does a clean report mean the PDF definitely has no malware?
No — a clean report means none of the known active-content markers were found, not a guarantee. Exploits that target bugs in a specific reader's rendering code can hide in ordinary-looking content, so keep your reader updated and stay cautious with files from unknown senders.
Is JavaScript in a PDF always malicious?
No — interactive forms legitimately use JavaScript for field validation and calculated totals, which is why the scanner reports what it found rather than declaring a verdict of malware. The combination to treat seriously is script plus an auto-run action, meaning code set to execute the moment the file opens.
What is an OpenAction and why does it matter?
An OpenAction is an instruction in the PDF's catalog that the reader executes automatically when the document opens — no click required. Harmless uses include jumping to page 1, but pointing one at embedded JavaScript or a Launch command is the classic delivery mechanism for PDF malware, so the scanner flags what any auto-run action actually does.
What should I do with a PDF that gets a high-risk verdict?
Do not open it in a desktop reader with scripting enabled; if you must see the content, use a sandboxed viewer that only draws the pages. If you need to keep or forward the file, strip its active content with a JavaScript-removal or sanitizer tool first, and when in doubt delete it and ask the sender to resend.