PDF Safety Checker
PDF Safety Checker: is this PDF safe to open?
Got an unexpected invoice, contract or delivery note as a PDF? Drop it here before you open it. The checker looks inside the file for the warning signs of a malicious PDF, such as hidden JavaScript, programs tucked inside, auto-run actions and dangerous links, and explains each one in plain language.
How the PDF Safety Checker works
A PDF looks like a simple document, but inside it is a small database of objects that can include scripts, actions, attached files and links. Attackers hide malicious code in these features because people trust PDFs more than programs.
This tool reads the file directly in your browser. It looks at the PDF’s internal structure, unpacks compressed sections where hidden code often sits, and counts the features that security analysts check first. It also calculates the file’s SHA-256 fingerprint, so you can look it up on VirusTotal without uploading it.
What the warnings mean
- JavaScript
- Scripts that run inside the PDF reader. Useful for some forms, but the most common building block of malicious PDFs.
- Automatic actions (OpenAction / AA)
- Something that happens as soon as you open the file or move through it. Combined with JavaScript, it is a strong red flag.
- Launch actions
- Instructions that try to start a program or open another file on your computer. Ordinary documents never need this.
- Embedded files
- Files attached inside the PDF. A hidden .exe, script or archive is a serious warning sign.
- Links
- Normal in many documents, but links to raw IP addresses, link shorteners or look-alike domains are typical of phishing PDFs.
- Forms and XFA
- Fillable fields are common. Be wary of any PDF that asks for passwords or card details, especially one that can submit your answers to a website.
- Disguised keywords and extra data
- Hex-encoded names and data hidden before or after the PDF are tricks used to slip past antivirus scanners.
Found something suspicious? Do this
- Don’t open the file, and never click “Enable” or “Allow” if a PDF reader asks for permission.
- Check with the sender using a phone number or address you already know, not the details in the email.
- Look up the SHA-256 hash on VirusTotal with the button in your results.
- Report it to your IT or security team, or use your email’s “Report phishing” option, then delete it.
- If you must view it, use your web browser’s built-in PDF viewer on an up-to-date device. It supports far fewer risky features than a full desktop reader.
- Harden your PDF reader: keep it updated, and in Adobe Acrobat or Reader turn off JavaScript under Preferences → JavaScript.
Frequently asked questions
Is my PDF uploaded anywhere?
No. The file is read by JavaScript in your own browser and never leaves your device. MAG212 CYBER does not receive it, and the VirusTotal button only searches for the file’s hash.
If the checker finds nothing, is the PDF safe?
Not necessarily. No scanner can prove a file is safe. A clean result means the usual warning signs are absent. A PDF can still lead to a phishing page through its text, so think about whether you were expecting it.
Why does a normal PDF show links or form warnings?
Many genuine documents contain links and fillable forms, so those appear as information, not alarms. The serious signals are JavaScript that runs on opening, hidden programs, launch actions and dangerous link types.
What if the PDF is encrypted?
Encryption can hide parts of the file from inspection. The checker tells you when this happens. Treat an unexpected encrypted PDF, especially one that comes with a password in the email, with extra caution.