Sanitize PDF
Disconnect JavaScript, embedded files, automatic actions, comments and metadata so a viewer can't run or open them.
Select a PDF fileor drop it anywhere on this page, or paste
Opens in your browser. Nothing is uploaded.
Sanitize PDF, free and private
Sanitize a PDF to strip the parts that can run code or act on their own: document JavaScript, attached files, actions that fire when the file opens, and link actions that open web pages, files or apps. You can also clear comments, metadata and form fields. The visible pages stay as they are.
This is a structural cleanup, not a malware scanner. It limits what a PDF can do when opened, but it does not check the file for threats or prove it is safe. It is free and runs in your browser, so the file is never uploaded.
How to sanitize a PDF
- 1
Add your PDF
Press Select a PDF or drop the file onto the page.
- 2
Choose what else to remove
The Always removed list shows what the file holds that is cleaned on every run, with counts. Under Also remove, Comments and links and Metadata are on by default and Interactive forms is off; each shows how many the file has.
- 3
Sanitize and download
Press Sanitize PDF. The summary lists what was removed, or says nothing risky was found. Check the file with Preview, then press Download sanitized PDF.
Why use PDFToolz for this
JavaScript removed every time
Document JavaScript, open actions and other automatic triggers are removed on every run. There is no setting to forget.
Removed for real
The file is rewritten with only the parts still in use, so removed scripts, attachments and metadata are gone from the file's bytes, not just hidden.
Navigation keeps working
Bookmarks, named destinations and jumps to other pages in the file stay. Only actions that run scripts or open something outside the file are removed.
Forms keep working
Fillable fields stay unless you turn on Interactive forms. Their scripts, such as calculations and validation, are removed.
Suspicious files stay local
The file is cleaned on your device instead of being sent to an online service.
What Sanitize PDF removes
Some items are always removed, because they are the main ways a PDF can run code or reach outside itself. Others are optional, because removing them changes how the document looks or works.
- Always: document JavaScript and the list of attached files.
- Always: actions that run when the file opens, closes, saves or prints, and automatic actions on single pages.
- Always: actions on links, bookmarks, comments and form fields that run scripts or open web pages, files or apps. A bookmark or link that jumps to a page in the same file keeps working.
- Always: form scripts, such as calculation, formatting and validation rules. The fields themselves stay. Any XFA form is removed too, because it can carry scripts. Regular fields keep working, but a form built only in XFA loses its fields.
- Optional, Comments and links: comments, highlights, drawings, stamps, attachment icons and link areas on every page. Form fields stay.
- Optional, Metadata: the title, author, subject, keywords, creator, producer and both dates are deleted, along with the XMP metadata stream.
- Optional, Interactive forms: every form field and its answer, and any XFA form, so the file no longer works as a fillable form.
Choosing the options
Turn Comments and links off if readers still need clickable links. Links to pages inside the file then keep working. Links to web pages stay as boxes on the page but no longer open anything, because their actions are always removed.
To keep filled-in answers visible while removing the form, run Flatten PDF first and sanitize the flattened file. To delete markup only, use Remove Annotations. To edit document properties instead of deleting them, use PDF Metadata.
What sanitizing a PDF does not do
Sanitizing shrinks what a PDF can do. Know where it stops:
- It is not malware detection. Fonts, images and page content are not scanned for exploits. Treat unexpected files with care even after cleanup.
- Visible page content does not change. To delete sensitive text or images for good, use Redact PDF.
- Any change to a signed PDF breaks its digital signatures, and certification settings are removed.
Frequently asked questions
Add the file here and press Sanitize PDF. Document JavaScript, open actions, page actions and script actions on links, bookmarks and form fields are removed on every run, with no extra settings.
It makes the file less able to act on its own. It is not a malware scanner and cannot guarantee a file is safe. Be careful with files from unknown senders even after sanitizing.
Yes, unless you turn on Interactive forms. Comments and links leaves form fields alone. Calculation and validation scripts are removed, so totals no longer add up on their own.
Yes. Bookmarks, named destinations and links that jump to another page in the same file are kept. Only actions that run scripts or open something outside the file are removed.
With Metadata on, the title, author, subject, keywords, creator, producer, creation date and modification date are deleted, along with the XMP metadata. The dates are removed, not replaced with a placeholder.
If the file opens without a password but blocks printing or copying, yes, add it directly. If it asks for a password to open, remove it first with Unlock PDF, then sanitize the unlocked copy.
No. The file is read and rewritten in your browser and saved straight to your device. The tool is free with no sign-up.
Last reviewed . See how we build and test our tools, or report an error.
