Sanitize a PDF

A PDF is not just a picture of a page. The format lets a file carry JavaScript, and lets that script be wired to run the moment the document is opened, or when a page is turned, or when it is printed or closed. It can also carry whole other files inside it, riding along invisibly. Almost no everyday document needs any of that, which is why those features are a favorite of people sending attachments they hope you will open. It is also why a document arriving from outside your organization is worth cleaning before it goes any further.

Drop a PDF and it is stripped immediately: embedded scripts, the open/close/print action slots that trigger them, and files attached inside the document. The page content is not touched. Text stays selectable, images keep their resolution, form fields still work, and nothing is rasterized. The result tells you exactly what came out, because a sanitized PDF looks identical to the one that went in and the count is the only evidence you get. A file that was already clean is handed back untouched and says so, rather than being re-saved to look like something happened.

All of it runs in your browser with pdf-lib, which is the part that matters for a security tool: a document you are unsure about is never uploaded to be inspected, so it is never sitting on someone else's disk. Removal is real rather than cosmetic. Each script and each embedded file is deleted from the document along with the objects it owns, not merely unlinked, so the payload is not left readable in the bytes. Your original file is not modified; the cleaned copy downloads as its own PDF.