PDF attachments viewer — the hidden files inside a PDF and why they matter for compliance and security
Most users do not realize PDFs can carry embedded files. Open a typical PDF in Acrobat and the attachments panel is empty; open certain regulatory filings, ZUGFeRD e-invoices, or technical reports and the panel surfaces multiple files inside — XML data, supplementary spreadsheets, source documents, original photos. Embedded files are a feature of the PDF spec but a surprise for users who do not know to look. Here is what the attachments viewer surfaces, the three categories of PDF where embedded files are common, and why compliance and security audits care about every attachment.
How embedded files work in PDF
The PDF spec lets a document carry arbitrary file attachments — any byte stream, with any MIME type, attached either at document level (in the /Names tree's /EmbeddedFiles entry) or at annotation level (a single page can carry attachment annotations). Each attachment has metadata: filename, MIME type, description, size, embedded bytes themselves (often compressed).
The attachments viewer parses both the document-level /EmbeddedFiles tree and any annotation-level attachments, then surfaces them as a structured list. You see what's inside the PDF without having to open it in Acrobat or run external tools.
Three categories where embedded files are common
Most PDFs have zero attachments. The cases where they DO are specific:
- E-invoice formats (ZUGFeRD, Factur-X). EU-standard hybrid invoice formats embed structured XML invoice data inside a human-readable PDF. The PDF is what you see; the XML is what your accounting system reads. Two views of the same invoice in one file. Common in B2B billing across Europe.
- Technical reports with source data. Research papers, lab reports, and engineering documents often embed the source data (CSV, JSON, raw measurements) so the methodology is reproducible. The PDF is the readable report; the data is right there inside for reanalysis.
- Archive packages. PDF/A-3 explicitly supports embedded files for archival. A PDF/A package might carry the original source document (DOCX, XLSX), supplementary exhibits, related PDFs, all in one archival container.
Why compliance audits care
Embedded files are invisible by default in most readers, but they travel with the document. Three audit-relevant concerns:
- PII leakage. An embedded file might carry sensitive information that the visible PDF did not. If you're redacting a PDF and forget the attachments, the redaction is incomplete.
- Tracking origin. Some PDFs embed the original Word doc as an attachment for reference. That source doc carries its own metadata — authors, tracked changes, comments — that may reveal information the published PDF was supposed to hide.
- PDF/A compliance gates. PDF/A-1 forbids embedded files; PDF/A-2 forbids them in compliance mode (but allows in PDF/A-3 with relaxed rules). Auditors check whether attachments are present and what they are.
Why security review cares
An embedded file in a PDF is a file. If you open the PDF and then double-click the attachment in Acrobat, your default application opens that file. Three threat patterns:
- Malicious payloads. An attached .docx with a macro, or a .js that triggers when opened. Some phishing campaigns hide payloads in PDF attachments because email scanners check the PDF itself but not what's inside.
- Steganographic data. Attached files might carry data hidden in image bytes, archive layers, or unused fields. Surfacing the attachment list lets reviewers scan for unexpected file types.
- Encrypted attachments. Some attachments are themselves password-protected. Surfacing them lets reviewers see what kinds of files are inside, even if they cannot read the content.
Viewer vs Extract — when to use each
Two related tools serve different needs:
- Attachments Viewer — list metadata. Surfaces filename, MIME, size, description. Read-only. Use when you want to know what's inside without pulling the bytes out. Fastest for audit and security review.
- Extract Attachments — pull the actual files. Decodes each attachment stream and saves the bytes to your disk. Use when you actually need to open or process the attached files.
Limits and compatibility
On the free web tool, attachments viewer handles PDFs up to 100 MB with no attachment-count cap. Parsing runs in your browser via byte-level parsing; nothing is uploaded. Output lists every attachment with full metadata, exportable as JSON.
Common pairings: Attachments Viewer → Extract Attachments to pull bytes. Attachments Viewer → AI · Redact if attachments reveal PII patterns that also need redacting in the main document.