Sanitize a PDF Before Sharing
Sanitizing a PDF means removing the hidden, easily forgotten layers that travel with the file: editable form fields, comments and other annotations, embedded attachments, scripts, and identifying metadata. This page does all of it in one click, on your device — it flattens form fields, removes every annotation, deletes attachments, strips JavaScript and auto-run actions, and wipes both the Info dictionary and XMP metadata. Visible page content is not touched, so text you can see on the page needs redaction, not sanitizing.
How it works
The tool performs five distinct clean-up operations in a single pass, each targeting a different PDF structure. First, form flattening: every field in the AcroForm dictionary is drawn into its page's content stream at the widget's rectangle — the value you typed becomes ordinary printed text — and the field itself is then deleted, so nobody downstream can alter the entry or inspect the field's history. Second, annotation removal: each page's /Annots array is cleared, which takes comments, highlights, sticky notes, stamps and drawn markup with it. Reviewer comments are the classic accidental leak — they often carry author names, timestamps and candid internal remarks.
Third, attachment deletion: PDFs can embed whole files in the /EmbeddedFiles name tree or as file-attachment annotations, and a contract PDF can silently carry the spreadsheet it was generated from. Both locations are emptied. Fourth, script stripping: the /JavaScript name tree, script OpenActions and additional-action (/AA) triggers are removed, the same operation the dedicated Remove PDF JavaScript tool performs. Fifth, metadata wiping: the Info dictionary (Title, Author, Subject, Keywords, Creator, Producer, dates) is cleared and the XMP metadata stream — a second, XML-based copy of the same information that many tools forget — is removed, as on Remove PDF metadata.
Be equally clear about the limit: sanitizing does not read or alter the visible page. If a page shows a salary, an address or an account number, it will still show it afterward. Removing content you can see requires redaction, which deletes the underlying text objects, not just the decorations around them. A sensible pre-share routine is: redact anything sensitive on the page, sanitize to clear the hidden layers, then confirm with the PDF risk scanner that the output reports no scripts, attachments or actions.
Illustrative example: a contract draft going to the other side
Illustrative scenario, not a recorded benchmark. File sizes, timings and results depend on the input and device. Try the reproducible samples.
A 22-page negotiated contract, 1.8 MB, was about to be emailed to the counterparty. Inspection showed what it was really carrying: 41 review comments from three named colleagues, 17 filled form fields still editable, a 640 KB Excel attachment embedded by the drafting tool, one document-level script, and metadata naming the author, the firm's document-management system and a "Draft-v7-internal" title. One click produced a 1.1 MB sanitized copy: the filled values were now fixed print, all 41 comments were gone, the attachment was deleted, the script was stripped and every metadata field read blank. The 0.7 MB saved was almost entirely the embedded spreadsheet — hidden payload, not page content.
Frequently asked questions
What exactly does sanitizing a PDF remove?
Five things in one pass: form fields are flattened into fixed page content, all annotations are removed, embedded file attachments are deleted, JavaScript and auto-run actions are stripped, and the Info dictionary plus XMP metadata are wiped. The visible pages themselves are left untouched.
Does sanitizing a PDF redact sensitive text?
No. Sanitizing removes hidden layers around the pages, but any name, number or address printed on the page stays fully readable. To remove visible content permanently, use a redaction tool, which deletes the underlying text as well as covering it.
Will the PDF look different after sanitizing?
Filled form values stay visible but become fixed page content instead of editable fields. Comments, highlights and sticky notes disappear entirely, because they are annotations. Everything that was ordinary page content — text, images, layout — is unchanged.
Is sanitizing the same as flattening a PDF?
Flattening is one of its five steps. Sanitizing additionally removes annotations, attachments, scripts and metadata, so it is the broader operation aimed at sharing a file safely rather than just locking in form values.
Is my PDF uploaded when I sanitize it here?
No. The file is opened and rewritten with pdf-lib inside your browser tab, and the download is generated on your device. Nothing is transmitted to any server, which you can verify by loading this page and then going offline.