PDF Hidden Data Scan

Look inside a PDF for JavaScript, automatic actions, attachments, layers, annotations, XFA forms and signatures.

PDF documents Client-side PDF object tree traversal

Tool preview

How to use it

! It scans the raw file structure, so it can flag objects a viewer never shows — and can occasionally over-report.
! It does not execute or analyse what any script actually does.
! Encrypted streams cannot be inspected, so findings may be incomplete for protected files.

Why is JavaScript in a PDF dangerous?

Scripts can run on open, call external URLs or trigger actions the reader did not intend.

What are layers and annotations?

Layers can hide content that is still stored in the file; annotations include comments and highlights that carry author names.

Is the file uploaded?

No, the scan runs on the bytes in this tab.

Processing happens in your browser using the File API, WebAssembly and Web Workers. There is no upload endpoint.

Inspect a PDF author, producer, creation date and XMP data.

Delete the author, producer, timestamps and XMP from a PDF.

Permanently delete the text instead of covering it with a black box.