Sanitize a PDF
A PDF that no longer triggers anything on its own.
Your files never leave your deviceDrop your PDF here
Form, document received by email, file of uncertain origin — PDF
How to sanitize a PDF, step by step
Automation mechanisms a PDF can carry — scripts, actions that run on opening — are removed directly in your browser, without touching the visible content.
Drop in the PDF
A password-protected file is refused, with a pointer to the unlock tool.
Check the loaded file
The name, page count, and size are shown before any processing happens.
Click “Sanitize”
VellumPDF removes the action that runs on opening, the extra actions on the catalog and pages, embedded scripts, and script actions placed on annotations.
Read the summary and download
A sentence states exactly what was removed, then the sanitized file downloads.
If no active elements are found, the message says so plainly instead of inventing a result: “No active elements found: this document was already inert.” The document’s metadata (title, author, producer…) is not touched by this cleanup — that is the metadata tool’s job.
Frequently asked questions
What exactly does VellumPDF’s sanitizing tool remove?
It removes JavaScript code embedded in the PDF, actions scheduled to run automatically when the file opens, and those attached to clickable links — mechanisms that are sometimes used for malicious purposes.
Does sanitizing change the visible content of the document?
No, the text, images and layout remain unchanged. Only the invisible active elements are removed.
Is this tool free, and does it work offline?
Yes, the analysis and cleanup happen entirely in your browser, without the file being sent to a server. A password-protected PDF must be unlocked before it can be sanitized.
What exactly is removed, technically?
Four entry points that the PDF structure declares explicitly: the action played when the file opens, the additional actions on the catalogue and the pages, the scripts embedded in the name tree, and script-type actions attached to an annotation. Ordinary hyperlinks are left alone: a link is not an execution mechanism.
Is this an antivirus?
No, and it is better said plainly. The tool does not scan images, fonts or embedded binary streams for malicious content. It removes the declared automation entry points, nothing more. A PDF can therefore still carry a risk this tool cannot see, and a file from a doubtful source stays doubtful after cleaning.
Does cleaning change anything on screen?
No. Text, images, layout and links stay identical; only the automatic-execution instructions disappear. A form whose calculations relied on scripts will stop computing on its own, though — that is the point, but worth knowing before cleaning a working form.