Remove JavaScript from a PDF
Removing JavaScript from a PDF means deleting the document's /JavaScript name tree, any OpenAction that runs a script when the file opens, the additional-action (/AA) triggers attached to the catalog, pages and annotations, and per-annotation script actions. This page does exactly that, locally in your browser: load a PDF, click once, and download a copy in which no script can execute. The file is never uploaded.
How it works
PDF scripts are registered in specific, well-defined places, which is what makes complete removal possible. Document-level scripts live in a name tree at /Root → /Names → /JavaScript: a sorted list of name/script pairs that the viewer runs when the document loads. A second entry point is the catalog's /OpenAction, which can point at a JavaScript action dictionary (/S /JavaScript) that fires the moment the file opens. Third, additional-action dictionaries (/AA) attach scripts to events: the catalog can script document close, save and print; individual pages can script page-open and page-close; and form-field widget annotations can script keystrokes, focus changes, formatting and calculation.
This tool walks all of those locations. It deletes the /JavaScript branch of the name tree, removes /OpenAction when its action type is JavaScript, strips /AA dictionaries from the catalog, from every page and from every annotation, and clears any annotation /A action whose subtype is /S /JavaScript. Non-script actions are preserved — a link annotation that opens a URL keeps working, because a visible link you choose to click is a different risk category from code that runs by itself.
It is worth understanding what PDF JavaScript is actually for, because it is not inherently malicious. Interactive forms use it heavily: an invoice template that multiplies quantity by unit price, a date field that rejects malformed input, an order form that shows a shipping section only when a checkbox is ticked — all of that is field-level JavaScript. The same engine, however, has been the classic delivery mechanism for PDF malware, because a script that runs on open can probe the viewer for exploitable bugs before the reader has seen a single page. Stripping scripts trades the conveniences for the certainty: after this tool runs, form auto-calculations, validation and formatting stop working, but nothing in the file can execute.
To see what a file contains before and after, run it through the PDF risk scanner, which reports every script, auto-run action, link and attachment it finds. A stripped file should scan clean of script entries.
Illustrative example: a scripted loan form
Illustrative scenario, not a recorded benchmark. File sizes, timings and results depend on the input and device. Try the reproducible samples.
A 14-page loan application form weighing 412 KB arrived by email. The risk scanner reported: 2 document-level scripts in the /JavaScript name tree, 1 JavaScript OpenAction, and 9 field-level calculation and format actions across the repayment table. After one pass through this tool the output was 405 KB — scripts are small, so the size barely moved — and a rescan reported 0 scripts, 0 auto-run actions. The form fields were still present and fillable, but the "Total repayment" field no longer updated itself when the loan amount changed; it had to be typed manually. That is the expected trade: the recipient's bank accepted the stripped copy, which their gateway had rejected in its original scripted form.
Frequently asked questions
What is JavaScript in a PDF used for?
Legitimately, it powers form automation: calculating totals, validating dates, formatting phone numbers and showing or hiding fields. The same mechanism can also be abused to open URLs, trigger downloads or exploit viewer bugs, which is why many organizations strip it before accepting files.
Is JavaScript in a PDF dangerous?
It can be. Scripts that run automatically on open have historically been a common delivery mechanism for PDF malware, especially in older or unpatched viewers. If you did not expect a PDF to contain scripts, removing them costs nothing and closes that door.
Will my PDF form still work after removing JavaScript?
The fields themselves remain fillable, but anything scripted stops: totals no longer calculate automatically, custom validation disappears and formatted fields accept raw input. If you need those behaviors, keep the original and share the stripped copy.
How do I check whether a PDF contains JavaScript?
Use the PDF risk scanner on this site: it lists every document-level script, OpenAction, additional-action trigger and annotation action it finds. Scan first, strip second, then scan the output to confirm it reports zero scripts.
Does removing JavaScript change how the pages look?
No. Scripts live in the document catalog and action dictionaries, not in the page content streams, so text, images and layout are byte-for-byte untouched. Only the script entries are deleted.