Free online tool
Check a suspicious PDF before you open it
Drop a suspicious PDF and inspect it before you open it: the tool scans the file's structure in your browser — JavaScript actions, launch actions, embedded files, XFA forms, and other flags — and explains each one in plain English, with the object number it sits in. Nothing is uploaded, the PDF is never rendered, and nothing inside it runs.
Quick answer
Quick answer
Drop a suspicious PDF of up to 25 MB and this tool scans its structure in your browser: JavaScript actions, launch actions, embedded files and other flags, each with a plain explanation. You get a Safe, Suspicious or Risky verdict — but it is a structural check, not antivirus, so a clean result never guarantees a file is safe.
Open the interactive PDF Threat Inspector
The interactive tool loads in the page. Enable JavaScript to enter data, process content, and download results.
Worked example — suspicious sample PDF
The built-in suspicious sample, as scanned by the tool.
| File | sample-suspicious.pdf |
|---|---|
| Verdict | Risky — 11 points |
| Flags found | /JavaScript, /Launch, /EmbeddedFile, /OpenAction, /URI |
| What to do | Do not open; delete or quarantine it |
What each flag means
| Flag | What it means | Risk |
|---|---|---|
| /JavaScript or /JS | A script that runs when the PDF opens | High |
| /Launch | Starts another program or file when opened | High |
| /EmbeddedFile | A whole file packed inside the PDF | High |
| /XFA | XML form that can run scripts and fetch data | High |
| /RichMedia | Embedded Flash or media content that can run code | High |
| /OpenAction | An action that runs the moment the file opens | Medium |
| /AA | Extra triggers on open, close, or page turn | Medium |
| /JBIG2Decode | Image filter with a history of reader exploits | Medium |
| /URI | A link to a web address — listed, not counted | Info |
| /ObjStm | Objects packed into streams, hidden from raw scans | Info |
What to do next
| Verdict | What it means | What to do |
|---|---|---|
| Safe | No flags found | Still check the sender, then open normally |
| Suspicious | Something unusual is present | Open only in a sandbox, or check it on VirusTotal |
| Risky | Serious markers found | Do not open — delete it or quarantine and report it |
About this tool
About the PDF Threat Inspector
Drop a suspicious PDF and inspect it before you open it: the tool scans the file's structure in your browser — JavaScript actions, launch actions, embedded files, XFA forms, and other flags — and explains each one in plain English, with the object number it sits in. Nothing is uploaded, the PDF is never rendered, and nothing inside it runs.
Detailed guide
How to get useful results from PDF Threat Inspector
What a PDF can hide
A PDF is not just a page. Under the visible text sits a small program of objects: pages, fonts, images — and, sometimes, actions. A PDF can run JavaScript when it opens, launch another program, submit form data to a website, or carry a whole file embedded inside it. None of that is visible while reading the document, which is exactly why a suspicious attachment is dangerous: the part you see is ordinary, and the part that acts is hidden.
Most PDFs are harmless — invoices, tickets, forms — and most of the flags on this page are rare in ordinary files. But the same features that make PDFs useful are the ones attackers abuse: a script that runs on open, an action that fires without a click, a file smuggled inside the document. The inspector exists for the moment before you open a file you did not expect.
How the inspector reads a PDF without opening it
The tool never renders the PDF and never runs anything inside it. It reads the file's bytes with the File API, checks the %PDF header and version, then scans the raw text for the names PDF uses for dangerous features: /JavaScript and /JS, /OpenAction, /AA, /Launch, /EmbeddedFile, /XFA, /RichMedia, /JBIG2Decode. Names can be hidden with hex escapes — /J#61vaScript means /JavaScript — so the scan decodes those before comparing.
Each match is tied to the object number it sits in, so the report can say where a flag lives, not just that it exists. The scan also reads the trailer for encryption, checks for the %%EOF and startxref markers, and lists embedded-file names and web addresses found in the file. Everything happens in your browser tab; the file is never uploaded.
What each flag means
JavaScript is the biggest one: a script inside a PDF runs when the file opens, and it is the most common marker in malicious PDFs. /Launch can start another program. /EmbeddedFile means a whole file is packed inside the PDF — it might be a document, or it might be an executable. /XFA forms and /RichMedia annotations can run scripts and fetch data too.
Some flags are less certain. /OpenAction runs an action the moment the file opens — often it only jumps to a page, but malware uses it to trigger a script. /AA adds triggers for opening, closing, or turning pages. /URI is just a web link, common in ordinary PDFs, and is listed so you can check the destination. /ObjStm packs objects into streams, which hides them from a raw scan — the report says so when it sees one.
How the verdict is worked out
Every flag carries points: high-severity flags are worth 3, medium ones 2, low ones 1, and informational notes 0. A file with no flags scores 0 and gets a Safe verdict. A score of 1 to 3 is Suspicious — something unusual is present, but it may have an innocent explanation. A score of 4 or more is Risky — the file has multiple serious markers, or one flag that alone is enough to be dangerous.
The score is deliberately simple and shown in the report, so you can see exactly why a file got its verdict. A lone web link adds no points at all — it is listed for you to check, not counted against the file. A version mismatch alone scores 1 and reads Suspicious, because a tampered header is worth a second look. A file with JavaScript and a launch action scores 6, and there is no innocent reading of that pair.
What to do next, by verdict
Safe means nothing was found — but it is not a guarantee, so still check the sender before opening an unexpected file, and keep your PDF reader updated. Suspicious means something unusual is present: do not open it on your main machine. Open it in a sandboxed viewer or a throwaway virtual machine, or check it on VirusTotal, which can compare it against dozens of antivirus engines.
Risky means the file has serious markers — JavaScript, a launch action, an embedded executable, or several of those at once. Do not open it. Delete it, or quarantine it and report it to your IT team or mail provider with the report this tool produces. If the file arrived by email, report the message as phishing rather than just deleting it, so the sender gets blocked.
What this check cannot see
This is a structural check, not antivirus. It reads names and structure in the raw file — it does not run code, decode every compressed stream, or know whether a script is malicious. JavaScript hidden only inside a compressed (FlateDecode) stream is not decoded in this version, and hex-obfuscated names beyond the #xx escape form may be missed. An encrypted PDF cannot be inspected at all; the report says so instead of pretending otherwise.
Obfuscation is an arms race: a determined attacker can hide indicators from any static scan. That is why a clean result must never be read as proof a file is safe — it only means this scan found nothing. The tool is a first triage step, not a verdict on the file's safety: use it alongside an updated reader, an antivirus scan, and the oldest security check of all, whether you expected the file.
Who uses a PDF threat check
Security teams and IT helpdesks triage suspicious attachments this way every day — usually with command-line tools like PDFiD and peepdf, which need Python installed. This tool brings the same first step to anyone with a browser: a colleague who received an unexpected invoice, a journalist handling a leaked document, a researcher opening a file from an unknown source.
It also fits the rest of this site's privacy tools. The Email File Scrubber cleans a saved email before you share it, the Data Anonymizer redacts text before you paste it, and this inspector checks a document before you open it. None of them uploads anything — the file never leaves your tab — which matters most exactly when the file is the thing you do not trust.
Quick guide
How to use this tool
- 01Drop a PDF file onto the upload area, or browse to choose one — up to 25 MB.
- 02The tool reads the file's bytes in your browser and scans for scripts, actions, embedded files, and other flags.
- 03Read the verdict — Safe, Suspicious, or Risky — and the points behind it.
- 04Open each finding to see what it means and which object it sits in.
- 05Copy the report, then follow the next step for the verdict — open, sandbox, or delete.
Capabilities
Features and supported formats
- Scans a PDF's structure for JavaScript, launch actions, embedded files, XFA forms, and RichMedia — without uploading or opening the file.
- Decodes hex-obfuscated names like /J#61vaScript, so renamed indicators are still caught.
- Ties every finding to its object number, and lists embedded-file names and web addresses found in the file.
- Scores each flag and explains the verdict — Safe, Suspicious, or Risky — in plain English.
- Flags the blind spots honestly: encrypted files, object streams, and compressed streams the scan cannot see through.
- Runs 100% in your browser; the file is never uploaded, stored, or executed.
Supported formats
Input: one PDF file, up to 25 MB. Output: an on-screen report — verdict, score, findings with object numbers, embedded-file names, and links — with a copyable text report. Nothing is downloaded unless you copy it.
Answers
Frequently asked questions
Does the PDF Threat Inspector upload my PDF?
No. The file is read with the File API and inspected only in your browser tab. Nothing is sent to a server, and the PDF never leaves your device.
Is a Safe verdict a guarantee that the file is safe?
No. This is a structural check, not antivirus. A Safe result means this scan found no indicators — it does not prove the file is harmless. A determined attacker can hide indicators from any static scan, so still check the sender and keep your reader updated.
What does JavaScript in a PDF mean?
It means the file contains a script that runs when the PDF is opened. Scripts are used for forms and interactivity, but they are also the most common marker in malicious PDFs, which is why this tool flags them as high severity.
Why is /OpenAction flagged if ordinary PDFs use it?
OpenAction runs an action the moment a PDF opens. Often it only jumps to a page, which is harmless. But malware uses the same feature to trigger a script with no click, so the tool flags it as medium severity and explains both readings.
What is the risk of an embedded file?
An embedded file is a whole file packed inside the PDF. It might be a harmless document, or an executable or script that runs when extracted. The inspector lists the embedded file names so you can judge before opening anything.
Can the tool check an encrypted PDF?
No. An encrypted PDF cannot be inspected, because its content is locked. The report says so instead of pretending otherwise — an encrypted file from an unexpected sender is itself a reason to be careful.
What is the file size limit?
One PDF at a time, up to 25 MB. Larger files are refused before any reading starts, so a huge file cannot freeze your tab.
Does the tool run the PDF's JavaScript?
Never. It reads names and structure from the raw bytes and produces a text report. Nothing inside the file is executed, and the PDF is never rendered as a document.
What should I do with a Risky file?
Do not open it. Delete it, or quarantine it and report it to your IT team or mail provider, with the copied report attached. If it arrived by email, report the message as phishing so the sender gets blocked.
Does this replace antivirus or VirusTotal?
No. It is a first triage step. For a Suspicious file, upload a copy to VirusTotal, which compares it against dozens of antivirus engines, or open it only in a sandbox or a virtual machine.
Why are compressed streams a blind spot?
Most PDF content sits in FlateDecode streams. This version scans the raw names in the file but does not decompress streams, so JavaScript that exists only inside a compressed stream is missed. The page says so, and stream decoding is the next upgrade.
Can I use it on my phone?
Yes. The file picker works on mobile browsers, and the whole check runs in the tab. Pick the PDF from your downloads or mail app and the report appears in seconds.