Skip to content

Check a PDF for active content

Check a PDF for active content: JavaScript anchors, launch actions, form and field actions, URI links and embedded files, each named with its location.

pdfauditsecurityjavascript

Upload

Files (1–1)
One PDF, up to 20 MB. The audit reads the document structure only; nothing inside it is run, opened or downloaded.
Questions people ask
What does the audit look at?
The document's declared active structures: a JavaScript or launch action offered when the document opens, a JavaScript name tree, form templates (XFA) and additional field actions, page and annotation actions including URI links that point somewhere other than a web page, and embedded file declarations. Each finding carries its location, a severity and a one-line description.
Is anything in the PDF executed, opened or downloaded?
No. The audit is a pure structure walk. Scripts are never executed, links are never followed or contacted, and embedded files are never extracted or read; only names and declared sizes are reported. The job has no network at all.
A clean result does not certify the PDF, does it?
Correct. Clean means the structures this audit models were absent. It is not a safety statement: real documents can combine ordinary features in ways no static audit can rule out. Treat the tool as a fast structured look before smarter scrutiny, not as an approval.
What do the severities mean?
High marks structures that offer to run code, such as JavaScript or launch actions. Medium marks structures that send data somewhere or open other documents, such as form submits or non-web link schemes. Informational covers web links and embedded-file declarations. The verdict folds them together.
Why are embedded files only counted, not listed in full?
Because names and declared sizes are enough to decide what to do next. Attachment payloads are never extracted or scanned here, so the report never pretends to know what is inside them. A dedicated virus scan of extracted payloads is a separate job this audit deliberately leaves to your own tooling.
What are the limits?
One PDF up to 20 MB. The structure walk is depth- and reference-capped, and the report states when the caps cut the walk short. Encrypted PDFs are refused rather than guessed at: decryption with a password is not supported.