PDFs can carry JavaScript that runs on open and files most viewers never show you. How to inspect a document before you trust it, sanitize what looks wrong, and use attachments safely yourself.
Most people treat a PDF as inert — a picture of a document, nothing more. It is not. The format supports embedded scripts, hidden file attachments and actions that fire the moment a document opens, which is precisely why malicious PDFs remain a common attack vector. Here is how to see what a file actually contains before you trust it.
PDFs can carry scripts. The capability exists for legitimate reasons — validating a form field, calculating a total, revealing a section when a box is ticked — and business forms use it routinely. The same mechanism can also run code on open.
Show JavaScript reveals any scripts a document contains so you can look before you open it in something that will execute them.
Finding a script does not mean the file is malicious — any interactive form is likely to have some, and most are entirely benign. What matters is what the code does. Validation logic looks very different from something reaching for external resources or attempting to launch a file.
If something looks wrong, do not open it in a reader that runs scripts. Run it through PDF Sanitize instead, which strips the JavaScript and leaves the pages readable but inert. You lose interactive form behaviour — a fair trade for a document you were not expecting.
PDFs can contain other files entirely. Desktop readers show an attachments or paperclip panel, but many mobile and in-browser viewers hide it, so embedded files routinely go unnoticed.
Extract Attachments pulls them out as a ZIP so you can see exactly what came along for the ride. Treat anything you extract like any attachment from outside your organisation — embedding files inside a PDF is a known way to slip past filters that only inspect the document itself.
It is worth saying that this is a genuinely useful feature, not just a risk. Add Attachments lets you embed supporting files inside a document so a package travels as one item — a report carrying the spreadsheet behind its figures, a tender document with its certificates, an invoice with its itemised data. Regulated industries do this constantly, precisely so the two cannot be separated.
Two practical notes if you use it. Support is uneven, so mention the attachments in the document text rather than assuming they will be found. And the PDF grows by roughly the size of what you attach — embedding a large dataset produces a file too awkward to email, which defeats the point.
Once you know a PDF is safe and you actually need to change it, PDF Studio Editor is a visual overlay editor — add text boxes, white out sections you want removed, highlight passages, and place images or a signature. Everything is flattened into the page on save, so you get a genuine PDF rather than a layered file only one editor understands. It also runs entirely in your browser, which matters for a document you were cautious enough to inspect first.
If some text will not select, it is not text — scanned pages contain pictures of words. Run OCR first to add a real text layer.
A PDF can carry scripts and hidden files, and most viewers will not tell you. Checking takes seconds, sanitising neutralises anything questionable, and the same attachment feature that creates the risk is genuinely useful when you control what goes in.