The PDF that arrived by email, and what it might be carrying

An invoice from a supplier. A signed contract back from the other side. A form the council sends you to fill in. You double-click, it opens, you read it. That is the entire ritual, and for the overwhelming majority of documents it’s fine.

What most people don’t know is that the file had the option to do something else first. A PDF can carry instructions that its reader carries out on its own — the moment it opens, when you land on a particular page, when you click a rectangle that looks like a link. files.co now strips that layer in the browser: remove active content from a PDF takes it out and leaves the pages exactly as they were.

What a document can be told to do

The instructions have a name in the specification — actions — and a handful of them do real work:

• Embedded JavaScript, registered at document level, which runs when the file opens. Nothing needs clicking.
• An open action, a single instruction fired as the document is displayed.
• Actions on pages, triggered by scrolling into or out of a given page.
• Actions on clickable areas, which is a link that does something other than go somewhere.
• Launch links, which ask your computer to open a program or a file on it.
• Form submissions, which post what you typed to a URL chosen by whoever built the form.
• An XFA layer, an older Adobe form format that ships with its own scripting engine bolted on.

Most of the time none of this is anybody’s plan. Corporate templates pick up a validation script and never lose it. Form generators wire a submit action to a URL that stopped existing years ago. A design tool adds a page action nobody asked for. It accumulates, and it gets forwarded along with the document.

Why you’d never notice

Because nothing about the page changes. A document carrying an open action looks identical to one that isn’t. There’s no badge, no marker, no line in the properties panel that a normal reader shows you. Forward the file to nine people and you’ve forwarded it nine times.

That’s the actual argument for looking. Not that documents are out to get you — that you have no way of telling from the outside, and until now no obvious way of doing anything about it either.

Cleaning without breaking the document

The naive version of this tool would delete every action in the file and hand it back. It would also destroy every hyperlink in it, because a hyperlink is an action: a clickable area with an instruction attached whose type happens to be “open this URL”. Same for a table of contents that jumps to chapter four.

So the sorting is done by the type of the instruction, not by where it’s sitting. Anything the reader would execute — code, launching a program, submitting a form, importing data, opening another document, firing the multimedia engine — is removed. Anything that merely navigates or presents is kept: links, internal jumps, page transitions, layer toggles. If we meet a type we don’t recognise, it stays, because breaking somebody’s document out of enthusiasm is worse than leaving one unknown instruction alone.

Two things follow from that. Your links survive. And your form still works: form fields are never removed, they just lose the scripts attached to them, so whoever has to fill the thing in still gets a whole form.

There’s also a quieter piece of work underneath. Removing an instruction from the document’s index isn’t the same as removing it from the file — the object holding the code can sit there unreferenced, invisible in any reader, still perfectly readable to anyone who opens the raw bytes. So each one gets deleted along with its payload, and the test that proves it searches the objects of the output file rather than the index.

The honest limit

Cleaning does not make a dangerous file safe. It removes what a reader could execute; it does nothing about what a page can claim.

A document that shows a convincing login screen and asks for your password works exactly as well with zero JavaScript in it. A fake invoice with a swapped bank account is a plain, entirely passive PDF. The layer this tool removes and the thing you’re most likely to actually be fooled by are not the same layer. Read the result as “this won’t run anything”, and keep reading the document with your ordinary suspicion intact.

The attachment question

A PDF can also carry whole files inside it, in a structure the page never shows — we went through the mechanics in a PDF is a container. Those aren’t active content: nothing executes them when the document opens. But they’re the usual way something else travels along, so they get their own box in the tool, listed by name, ticked to keep by default. You decide.

The honesty that goes with that: if you keep an attachment, whatever is inside it is still inside it. Cleaning the PDF doesn’t reach into a spreadsheet riding in the back.

Where this fits

It works like the rest of the site: the file is read in your browser, processed there, and never sent anywhere. Before it changes anything, the tool tells you what it found — and if the document carries nothing, it says so and hands you back the file you already had rather than a pointless re-saved copy.

Two good moments to use it. On a document that arrived from outside and is about to be forwarded internally, and on one of yours that’s about to go out to the world. That second case pairs with what to check before sending a PDF, and with what a PDF says about itself, which will flag embedded JavaScript and open actions in a document without changing it — useful when you want to look before you touch anything.