Can a PDF contain JavaScript?
Yes. The PDF format lets a document carry actions: small instructions a viewer carries out when something happens, such as the file opening or a link being clicked. One type of action is JavaScript. Viewers that support it can run scripts to check what you type into a form, calculate totals, show messages or react when a page opens. Most everyday PDFs contain no JavaScript at all, and many that do use it for ordinary form behaviour. Still, a script you didn't expect is worth knowing about before you open or pass on a file.
Where can PDF JavaScript be stored?
- When the document opens
- An opening action runs as soon as the file is opened in a viewer that supports it.
- Document-level scripts
- Named scripts stored with the document, usually loaded when it opens.
- Document and page events
- Actions for printing, saving or closing the file, or for opening and closing a page.
- Links, bookmarks and annotations
- What happens when you click a link or a bookmark, or move the mouse over an annotation.
- Form fields
- Scripts that format, check or calculate a field's value while you fill in the form.
Actions can also be chained, so one action runs another afterwards. PDFSanitize follows those chains and counts each action once, and it reports damaged chains that loop back on themselves.
Does every PDF action contain JavaScript?
No. Most actions are plain navigation. A web link opens an address in your browser. Internal navigation jumps to another page or section of the same document. Other actions open a different PDF, send or load form data, reset a form or ask the viewer to print. This tool reports each type separately, so an ordinary link is never counted as a script.
Does PDFSanitize execute PDF JavaScript?
No. It reads the structure of the file: where each action is attached, what type it is and how many characters of script it contains. Scripts are never run, evaluated or shown, links are never followed, and nothing is sent anywhere. The page itself blocks outgoing network connections while the tool runs.
What the tool shows about each action
Before anything is removed, you see how many actions of each type the file contains, and which ones will be kept. The details list every action's type, where it's attached (for example “When page 2 opens” or “Form field ‘Amount’ while typing”) and, for scripts, how many characters of script it holds. The script itself is never displayed, so nothing from inside the PDF is shown as code on the page.
What does this tool remove?
By default it removes JavaScript wherever it finds it, and launch actionsthat ask the viewer to open a file or application. You can also choose to remove actions that submit or import form data, and links that open another PDF. Only the action is removed: the link, annotation, form field or page that held it stays in the document. Other action types are listed and kept.
Does removing JavaScript remove links?
No. Web links and internal navigation are kept. If a link first ran a script and then opened a web address, the script is removed and the link still opens the address. After cleaning, the tool re-opens the new copy and checks that the selected actions are gone, that no JavaScript remains anywhere it looks, and that links, form fields and their values, attachments, metadata, page count and page content match the original. If they don't, the result says “Cleaned with limitations” instead of reporting success.
What about forms and signed files?
Form fields and their values stay. Scripts attached to them are JavaScript too, so once removed, automatic formatting or calculation stops working in the cleaned copy. To clear the values themselves, use Clear PDF Form Fields. Removing actions rebuilds the file, which invalidates any digital signature, so you're asked to confirm first when one is detected.
Does this remove attachments or metadata?
No. To remove embedded files, use Remove PDF Attachments. To remove the author, title and other document properties, use the PDF Metadata Remover.
Should I check the PDF again afterward?
It's a good habit. Run the cleaned copy through the PDF Privacy Checker to see its metadata, comments, annotations, form fields, attachments and any remaining actions in one report.