PDF Cleanup & Sanitizer

Runs in browser PDF Optimization

Inspects the document for active content and private data and removes what you tick — scripts, auto-run actions, embedded files, external links, comments, form fields, metadata — reporting exactly what was found and removed.

Privacy: Processed locally in your browser. Your file is not uploaded.

How do PDF passwords, permissions and redaction work?

PDF encryption (ISO 32000, AES-256 in current files) has two passwords: the user password opens the document, the owner password controls permissions such as printing, copying and editing. Permissions are advisory flags that compliant readers honour, not a cryptographic barrier. Redaction is different from covering: a black box drawn over text leaves the text in the file, whereas true redaction removes it from the content stream — and metadata, attachments and thumbnails can leak what the pages no longer show.

Security note: Before sharing a redacted or "cleaned" PDF, inspect its metadata and text layer: what a viewer cannot see may still be in the file. Permissions stop honest readers, not determined ones.

Read the guide: How to Edit a PDF Without Uploading It

How to use PDF Cleanup & Sanitizer

  1. Drop a PDF.
  2. Tick what to remove (scripts, actions, attachments and metadata are on by default).
  3. Click "Clean up".
  4. Download the sanitised file.

PDF Cleanup & Sanitizer features

  • Removes JavaScript, OpenAction / AA, Launch / GoToR / SubmitForm / ImportData actions
  • Removes embedded files and file-attachment annotations
  • Document metadata removed by default (untick to keep it)
  • Optional: links, all annotations, form fields
  • Report of what was found and what was removed
  • Never executes any content
  • Local processing

PDF Cleanup & Sanitizer example

A form received by e-mail

Input:

form.pdf — 3 JavaScript actions, 1 OpenAction, 2 attachments

Output:

form-sanitized.pdf — 6 items removed; links and fields kept

Frequently asked questions about PDF Cleanup & Sanitizer

Why would a PDF contain JavaScript?

Forms use it for calculations and validation, and some generators add it for printing or navigation. It is also the classic vector for malicious PDFs, which is why removing it before sharing or archiving is good hygiene.

Does this make a PDF safe?

It removes the active-content features that attackers use — scripts, launch and remote actions, embedded files, multimedia — and this site never executes any of them. It is not an antivirus and cannot judge the intent of the remaining content.

Will links inside the document stop working?

Only if you tick "Links". By default internal and web links are kept; only actions that run a script, launch a program, open another file, submit or import form data, or play media (JavaScript, Launch, GoToR, SubmitForm, ImportData, Sound, Movie, Rendition, GoTo3DView) are stripped.

Is my PDF uploaded to a server?

No. The file is opened and processed by your browser with WebAssembly and JavaScript; nothing is sent to Mutqan Soft or anyone else. Close the tab and the file is gone. Downloading the result needs a free account — no subscription, no payment.

Can I use it on a password-protected PDF?

Yes, if you know the password: the file list asks for it once and every operation then works on the decrypted pages. The output is saved without a password unless you protect it again.

Technical notes

The engine walks every dictionary reachable from the catalog and the object table, deletes /JS, /JavaScript, /OpenAction, /AA, the Names/JavaScript and Names/EmbeddedFiles trees, risky /A actions (Launch, GoToR, SubmitForm, ImportData, Sound, Movie, Rendition, GoTo3DView) and multimedia annotations, and drops the removed annotation objects from the file.

References