PDF Sanitizer

Why It Matters

Security reports and bug bounty submissions often arrive as PDF attachments, and a malicious PDF can carry embedded JavaScript, launch actions, or hidden files that target whoever opens it. The PDF Sanitizer turns an untrusted PDF into a flattened copy that is safe to open, so you can read the contents without running anything the original author embedded.

What It Does

The sanitizer rasterizes every page to an image and rebuilds a fresh PDF from those images. Because the output is rebuilt from scratch, JavaScript, embedded files, and document actions in the original are dropped.

The result is image-based: it looks like the original but has no selectable text layer, so you cannot copy and paste text out of it.

Sanitizing a PDF

Open the PDF Sanitizer page. Any signed-in account member can use it.

1. Drag and drop a PDF onto the page, or click to choose one.
2. The file processes in the background.
3. When it finishes, the page updates automatically with a Download safe PDF button.

How It Stays Safe

The risky conversion runs in an isolated, network-restricted sidecar service that holds no account data. A malicious PDF cannot reach your data even while it is being converted.

PDFs with embedded active content are screened and rejected before conversion. If a conversion fails for any reason, it fails closed — no output file is produced.

Limits

Limit	Value
File type	PDF only
Maximum size	25 MB
Output	Image-based — no selectable or copy-paste text

AI Tool: sanitize_pdf

The sanitizer is also available as an MCP/AI tool named sanitize_pdf. It takes a base64-encoded PDF and returns a sanitization id and status, so an AI assistant can sanitize an attachment as part of a triage workflow.

Quick Checklist

• Confirm the file is a PDF and under 25 MB
• Upload it on the PDF Sanitizer page
• Wait for the Download safe PDF button to appear
• Open the sanitized copy instead of the original