What exactly gets removed?

Annotations, embedded files and attachments, document-level JavaScript actions and metadata, all in your browser. Deep content-stream auditing — hidden layers buried inside page content — needs server-side tooling and is not claimed here.

Is sanitising the same as redacting?

No. Sanitising removes the extras around the pages; redaction removes visible content on the page itself. Do both if the document has secrets in both places.

Will my form still work after sanitising?

Field data and annotations are stripped, so a filled form becomes a record of what it looked like rather than something to complete. Keep the original if you need to keep filling it.

Sanitize PDF

Beta

Remove annotations, embedded files, JavaScript and metadata.

Removes annotations, attachments, document-level JavaScript actions and metadata in-browser. Deep content-stream auditing (e.g. hidden layers) needs server-side tooling.

Drag & drop your PDF here

or click to browse — .pdf · up to 1 files

Also remove document metadata (title, author, timestamps)

Annotations/comments, embedded files, document-level JavaScript actions and (optionally) metadata are stripped, then the file is rebuilt from scratch. Deep content-stream auditing (hidden layers, OCG optional content) needs server tooling and is not performed here.

Add a PDF first.

Loading tool…

About Sanitize PDF

Sanitize a PDF by removing the things a document carries besides its pages: annotations, embedded files, attachments, document-level JavaScript actions and metadata. What it does not do is audit the content stream itself, so hidden layers remain a job for server-side tooling. It is the pass you run before opening a PDF from someone else, or before sending one on.

Cleaning a document before it leaves, or neutralising one that arrived from outside.

How to use Sanitize PDF in 3 steps

Drop the PDF you want to clean.
Start the sanitising pass; annotations, attachments, scripts and metadata are removed.
Download the cleaned document.

What you get with Sanitize PDF

Strips embedded JavaScript actions, which are a real attack path in PDFs
Removes attachments, comments and form field data you did not ask for
Local processing — a suspicious file is never uploaded anywhere
Free to use, with no signup and no account
No watermark or logo added to your output
Works on desktop and mobile, no install

Sanitize PDF: questions

What exactly gets removed?: Annotations, embedded files and attachments, document-level JavaScript actions and metadata, all in your browser. Deep content-stream auditing — hidden layers buried inside page content — needs server-side tooling and is not claimed here.
Is sanitising the same as redacting?: No. Sanitising removes the extras around the pages; redaction removes visible content on the page itself. Do both if the document has secrets in both places.
What can't Sanitize PDF do?: Removes annotations, attachments, document-level JavaScript actions and metadata in-browser. Deep content-stream auditing (e.g. hidden layers) needs server-side tooling. That limit is stated on the page and in the alert above the tool, not buried in a footnote.
Will my form still work after sanitising?: Field data and annotations are stripped, so a filled form becomes a record of what it looked like rather than something to complete. Keep the original if you need to keep filling it.