PDF JavaScript Detector

Free

Find every JavaScript handler embedded in a PDF — security review for phishing, exfil, malware. Free, in-browser.

What you'll get: every JavaScript handler in the PDF, with trigger, location, code preview, and severity classification. For another use, try PDF/A Check.

Loading tool…

Stays in your browser

Free tools run fully on-device — nothing is uploaded to a server.

No watermarks

Clean output, no branding, no daily limits.

Free forever

No signup required. Seriously.

Why people scan PDFs for JavaScript

PDFs can contain JavaScript that fires on open, on form fill, on link click. Most users don't expect this — and most malicious PDFs use it. Knowing what's in there matters.

Security review

Suspicious PDF in your inbox? Scan for embedded JS before opening. High-severity handlers (network requests, file system access) are red flags for phishing or malware.

Compliance audit

PDF/A and many regulatory standards forbid JavaScript. Quickly verify a document is JS-free before submitting to an archive or compliance pipeline.

Migration / re-export

Forms with JS validation behave differently across viewers. If you're re-exporting an old form, knowing the JS surface helps you reproduce or replace it.

Documentation

Inheriting a fillable PDF from a previous developer. Scan for JS handlers to understand the form's behavior before modifying it.

Forensic analysis

Investigating a suspicious document — the JS handler list shows triggers (open, form-fill, link-click) and code previews to assess attack surface.

How PDF JavaScript Detector works

Three steps, no signup, no uploads.

STEP 1
Drop your PDF
Up to 100 MB. Byte parser scans for /JS and /JavaScript tokens across the entire document.
STEP 2
Click Scan for JavaScript
We surface every JS handler with its trigger, location (document/page/form-field/link/named), and a 200-char code preview.
STEP 3
Review severity
Each handler gets a heuristic severity: high (network/file system access), medium (form manipulation), low (cosmetic). High-severity ones deserve careful review.

What makes pdfcraft ai different

Same engine Chrome uses
PDFium is Google's PDF engine — the one that powers Chrome's built-in PDF viewer. We compile it to WebAssembly so it runs in your browser at near-native speed.
100% local processing
Most free PDF tools upload your file to a server, process it, and stream the result back. We don't. Your file lives in your browser tab and never touches our infrastructure. Verifiable in your browser's Network panel.
No watermark, no signup, no daily limit
Convert 1 PDF or 1,000. We don't gate on volume because there's nothing to gate on — the engine runs on your machine.
Honest about limitations
When something the tool can't do (encrypted PDFs, cross-reference streams), we tell you clearly instead of failing silently. Same for partial results: sampled vs exact, embedded vs not.
Open standards, free engines
PDFium is BSD/Apache licensed (free for any use). We don't pay vendor license fees and pass that savings on to you (and to ourselves) as a free, ad-supported tool with no upgrade-to-pro pressure.

Frequently asked questions

Is the severity classification reliable?

Heuristic, not authoritative. We classify based on JS API patterns (xhr/fetch/launchURL = high; getField/setField = medium; everything else = low). It's a triage signal — high-severity handlers in an unsolicited PDF deserve a careful read; low-severity is usually benign form math.

Does it execute the JavaScript?

No. We only read the code as static text — it never runs. That's the whole point: you can inspect a suspicious PDF safely without opening it in a viewer that would execute its handlers.

What if the PDF has no JavaScript?

We tell you clearly with a 'No JavaScript detected' headline. That's the safer state — a PDF without scripts is statically readable, which is what archive standards require and what cautious viewers expect.

Why might my PDF have JavaScript I didn't put there?

Form-builder tools (Adobe LiveCycle, FormCalc) inject JS for validation and calculation. Print-driver software sometimes adds open-actions for analytics. Older Acrobat Pro features add helper scripts. Most of these are low-severity — 'high' is the one to focus on.

Is anything uploaded?

No. Pure byte-stream parsing in your browser. The whole point of a security tool is not to upload the suspicious file you're checking.

Want full archive compliance?

PDF/A Compliance Check confirms whether your PDF meets archive standards — JS-free is one of the requirements.

Try PDF/A Check

Related PDF tools

Other tools in the Inspect category — built on the same private, in-browser pipeline.

PDF InspectorFree

See everything inside a PDF — pages, dimensions, word count, reading time + mixed-size warnings. Free, in-browser.

Visual DiffFree

Pixel-level visual diff between two PDFs — output a comparison PDF with red highlighting on regions that differ + per-page diff percentage. Pairs with AI Compare for content-level diffs.

Search in PDFFree

Find any word or phrase across every page of a PDF. Case-sensitive and whole-word options, with surrounding context. Free, in-browser.

PDF Outline ViewerFree

View the bookmark / table-of-contents tree of any PDF, with page references. Useful for previewing long docs before reading. Free, in-browser.

PDF Form InspectorFree

List every AcroForm field in a PDF — name, type, value, required/read-only flags. Export as CSV or JSON. Free, in-browser.

PDF Attachments ListerFree

List every embedded file in a PDF — filename, description, MIME type, size. Useful for compliance audits and security review. Free, in-browser.