Most PDFs are just pages, but the format can also run actions: JavaScript, links that open when a file is opened, buttons that submit a form to a web address, a request to launch another file. Forms and some business documents use these legitimately; a document that should be a plain invoice or contract usually has none. This scanner opens a PDF as data, reads its structure and lists every action, embedded file and similar feature, says where each one sits, whether it can run without a click, and what it means.
It is a structural inspection of the PDF's objects. It is not an antivirus, it does not run any script, and it never says a file is safe, virus-free or malware-free. The file is not uploaded.
Loading the tool…
Overview
About PDF Active Content Scanner
What it looks for. Following ISO 32000 (actions in clause 12.6, additional actions, name trees and embedded files): JavaScript actions and the document-level JavaScript name tree; OpenAction and additional actions (AA) on the document and on pages; Launch actions; SubmitForm and ImportData actions; GoToR and GoToE jumps to other files; URI actions with their web addresses; Named, Hide, layer and multimedia actions; embedded files in the EmbeddedFiles tree and as file-attachment annotations, with a flag for executable and script file types; XFA forms; and rich-media, 3D, screen, movie and sound annotations. Names written with #-escapes, a trick used to hide keywords, are decoded.
How it is reported. Each item shows its type, where it sits in the document (for example "Document /OpenAction" or "Page 3 /AA"), its target or the start of the script, keywords found in a script (such as eval, unescape, app.launchURL or submitForm, which are listed as information, not as proof of anything), and a short explanation. Items that are attached to a trigger that can run without a click (document open, page open or close, the document JavaScript tree) are marked "can run automatically" and rated higher. Actions in objects that are not reachable from the document catalog are listed separately as notes, because a normal viewer does not run them.
Raw keyword counts. As a tool such as pdfid does, the scanner also counts keywords such as /JavaScript, /JS, /OpenAction, /Launch, /EmbeddedFile and /XFA in the raw file. Many PDFs keep their structure in compressed object streams where those keywords cannot be seen without decoding; that is why the main findings come from the full object graph and the raw counts are only an indicator.
Encrypted files. Strings and streams in an encrypted PDF cannot be read, so the contents of actions are not available; the report says so and the raw counts still apply.
Compatibility
Supported Formats
PDF files up to 80 MB (any PDF version). Password-protected PDFs are read as far as their structure allows, with a notice that strings are encrypted. Not supported: other formats (Office files can be checked with the metadata tool), and anything beyond structure, such as scanning fonts or images for exploits.
Guide
How to Use PDF Active Content Scanner
- Drop a PDF onto the box (up to 80 MB). It is read as data; nothing in it is run.
- Read the summary: how many JavaScript actions, how many can run automatically, embedded files, XFA.
- Go through the findings, starting with those marked as running automatically, and read where each sits.
- Download the report as JSON if you need to pass it on, and decide with the sender or your IT team what to do with the file.
Highlights
Features
- Actions and triggers JavaScript, OpenAction, AA, Launch, SubmitForm, URI, GoToR and more, with their location.
- Can it run automatically? Triggers that need no click are marked and rated higher.
- Embedded files and XFA Names, sizes and a flag for executable or script file types.
- Plain-language explanations What each item is, why it matters and what the script contains.
- Nothing is run or uploaded A structural inspection in your browser, never a safety guarantee.
Applications
Use Cases
- Looking at an unexpected PDF attachment before opening it in a full viewer
- Checking that an invoice or contract PDF contains no scripts or launch actions
- Finding out what a fillable form does when you click its buttons
- Seeing the files hidden inside a PDF portfolio or attachment tree
- Learning what OpenAction and JavaScript mean in a real document
Good to Know
Limitations
This is a structural PDF inspector, not an antivirus scan. It does not say that a PDF is virus-free, malware-free or completely safe, and it gives no security guarantee. Exploits that live in fonts, images, compressed streams or in a bug of a particular viewer, and anything inside an encrypted PDF, are outside what it can see. A file with no findings can still be harmful, and a file with findings, such as a fillable form, is often harmless.
Items are found by walking the document catalog and the pages; unusual or damaged structures may hide an action from the walk, which is why raw keyword counts are shown too. Script text is shown as written and is never run.
This tool runs entirely in your browser — your file is never uploaded to our servers. See our Privacy Policy for full details.
Support
Frequently Asked Questions
Does the scanner run the PDF's JavaScript?
No. The PDF is read as data. Scripts are shown as text and are never run.
Does "no findings" mean the PDF is safe?
No. It means the structural inspection found no actions or embedded files. Exploits in fonts, images or viewer bugs, and encrypted content, are outside what this tool sees.
Is my PDF uploaded?
No. The file is inspected in your browser and is not sent to our server.
What is OpenAction?
An entry in the document that names an action to run when the file is opened, for example jump to a page or run a script. Scripts and launch actions there are the ones to look at first.
Why does a fillable form show JavaScript?
Forms often use JavaScript for calculations and validation. It is normal there; the scanner shows what the script contains and where it is triggered.
What are the raw keyword counts?
A plain text count of keywords such as /JavaScript or /OpenAction, like the pdfid tool. Keywords inside compressed object streams are not visible in it, so the findings above are the more complete result.
Keep Going
Related Tools
- PDF Structure & Validity Checker Check a PDF's internal structure for damage most viewers silently repair and never tell you about — free and instant.
- PDF Attachments Extractor List every file embedded in a PDF, see what each one really is, and download one or all of them. The PDF stays in your browser.
- Office Document Inspector & Metadata Remover Remove metadata from Word, Excel and PowerPoint files: see author names, comments, tracked-change authors, hidden sheets and speaker notes first, then clean a copy. In your browser.
- PDF Redaction Checker Check whether a redacted PDF still contains the text under black or white boxes: finds selectable text beneath overlays, unapplied redaction annotations and words you name. In your browser.
- MSG & EML Email Viewer Open MSG and EML email files online: headers, sender and recipients, HTML or plain-text body, attachments you can save, print or save as PDF. HTML is sandboxed and remote content blocked. In your browser.
- Office Embedded Object & Macro Risk Scanner Inspect a Word, Excel or PowerPoint file for VBA macros, ActiveX, OLE objects, embedded files, external links and templates, with severity and plain explanations. A structural scan, not an antivirus. In your browser.
- Send-Safe Document Checker Before you send a confidential PDF, Word, Excel or PowerPoint file: one overview of hidden information such as metadata, comments, tracked changes, hidden sheets, notes, attachments, scripts and macros, and which tool to use next. In your browser.