About PDF Security Checker
A PDF can carry more than text and images: scripts that run on open, commands that launch programs, links to phishing pages, and files hidden as attachments. This PDF security scanner inspects the file structure and gives it a clear risk score, so you can scan a PDF for malware indicators before you open it.
The scan covers the four areas security researchers look at first: embedded JavaScript and automatic actions, external links, embedded files, and raw structure anomalies such as incremental updates or data past the end of the file.
Everything happens locally in your browser. The file is never uploaded, so even confidential documents can be checked safely.
How to use PDF Security Checker
- Select or drop the PDF you want to inspect.
- Press Check security and wait a moment while the structure is analyzed.
- Read the score and the verdict, then review each finding in detail.
- If something risky turns up, run the file through Sanitize PDF before opening it.
Security score
A 0-100 score with a plain-language verdict, so you can judge a file at a glance instead of parsing a technical report.
Script and action detection
Finds embedded JavaScript, actions that fire when the document opens, event-triggered automatic actions, and commands that try to launch external programs.
Link analysis
Every external link is extracted and checked for warning signs: plain HTTP, raw IP addresses, URL shorteners, look-alike punycode domains, and downloads of executable files.
Attachment and structure audit
Lists embedded files with their names and sizes, flags executable attachments, and reports structure oddities like hidden older revisions or trailing junk data.
What the checker looks for
Embedded JavaScript is the most common attack channel in malicious PDFs. Scripts can be wired to run the moment the file opens, drop a payload from an attachment, or connect to a remote server. Even benign files sometimes carry tracking scripts, so any hit deserves a look before you open the document.
Links are compared against a checklist of phishing indicators. A single plain-HTTP link is usually just an old document, but combinations like a shortened URL pointing to an executable download, or a domain spelled with punycode to imitate a brand, are classic lures.
Embedded files are not always malicious: portfolios and invoices legitimately use attachments. The checker lists them all and raises the alarm for executable types such as EXE, BAT, JS or APK hidden inside the PDF.
Structure checks work on the raw bytes. Incremental updates leave older revisions of the document inside the file, data after the final end-of-file marker can hide payloads from scanners, and hex-escaped names are a known trick to disguise the word JavaScript itself. These are signals, not proof: plenty of honest files have one of them.
How the scan works: the file is read locally into memory, hashed with SHA-256 for reference, and walked through a real PDF object parser, not just a text search. That means scripts, links and attachments hidden inside compressed object streams are still found. A raw-byte pass covers what parsers normalize away, such as hex-escaped names that disguise the word JavaScript. The heavy work runs in a background worker thread, so even large files cannot freeze the page, and nothing found in the file is ever executed or visited.
Limits you should know: this is heuristic static analysis, not antivirus. It cannot execute code, so heavily obfuscated or brand-new attack techniques can slip past a clean-looking result. Password-protected files can only be checked structurally, damaged files may refuse to parse, and files beyond the size limit are only partially inspected. Whenever the scanner cannot see something, it says the scan is incomplete instead of reporting the file as clean.
Tips for better results
- A low score is a strong warning, but a high score is not a guarantee. Static analysis cannot see everything, so treat files from unknown senders with care regardless of the score.
- Password-protected PDFs can only be checked structurally. Unlock a copy first if you need the full scan.
- If the checker flags scripts or attachments you do not need, Sanitize PDF removes them in one pass.
- For files that arrive by email, verify the sender separately. A perfect-looking invoice from a look-alike domain is still a scam.
Questions and answers
Is my file uploaded anywhere?
No. The analysis runs entirely in your browser with the same engine the tools use for editing. Nothing is transmitted.
What does the score mean?
The file starts at 100 points and loses points for every risky feature found: embedded JavaScript, launch commands and hidden executables cost the most, suspicious links and structure oddities cost less. 85 and above reads as clean, below 35 is dangerous territory.
Can a clean score prove the file is safe?
It cannot. The checker is a static analyzer: it reads what is written in the file, it does not execute it. Novel or heavily obfuscated attacks can slip past, so keep using common sense.
Why does my normal PDF have findings?
Interactive forms, legal documents and portfolio PDFs legitimately use forms, links and attachments. The severity color and the item list help you tell expected features from genuinely risky ones.
What should I do with a dangerous file?
Do not open it. Delete it, or if you must read it, first strip it with Sanitize PDF and open the sanitized copy in an up-to-date reader.
Can this tool detect malicious PDF JavaScript?
Yes, that is its core check. Document-level scripts, actions wired to run when the file opens, event-triggered actions and XFA scripts are all reported with a code snippet as evidence, including scripts hidden inside compressed object streams.
Is this an antivirus?
No. It is a static, heuristic scanner for PDF-specific risk indicators. It complements, but does not replace, a real antivirus: use it to decide whether a file deserves a closer look, not as proof that a file is harmless.