Loading page
About this tool
Perform a bounded local lexical inspection for PDF JavaScript, actions, launch cues, attachments, forms, rich media, and external references without executing them.
The PDF Active Content Inspector counts the structural name markers that indicate a PDF can do something beyond display text — /JavaScript and /JS, /OpenAction and /AA, /Launch, /SubmitForm and /ImportData, /URI and /GoToR, /EmbeddedFile, /AcroForm and /XFA, /RichMedia and /Named — grouped into nine categories. It is a bounded lexical pass that reads the file's token structure only: stream bodies, comments and string values are skipped, and no script, action, URL, attachment or media is ever decoded, followed or executed. It is a triage aid for security, IT and document-handling teams, not a parser, sandbox or antivirus scanner.
Open PDF Active Content Inspector on AltFTool — it loads instantly in your browser.
Press Choose PDF and pick one local file, maximum 20 MB, carrying a %PDF- header in its first 1,024 bytes.
The bounded pass counts markers across nine categories; check Selected cues, Tokens inspected and Streams skipped for truncation warnings.
Press Export counts to save pdf-active-content-cue-counts.json, which holds tallies but no scripts, URLs or filename.
Findings arrive as nine named categories — JavaScript, automatic actions, launch actions, form submission, external references, attachments, forms, rich media and named commands — instead of a raw string-grep hit list.
Only the presence and count of names is reported; target paths, script bodies, URLs and embedded files are never extracted or displayed, so inspecting a hostile file cannot leak its payload into your screen or clipboard.
If an /Encrypt or object-stream marker appears, the token ceiling of 450,000 is reached, or a stream or string is malformed, the result says so explicitly rather than reporting a clean file.
No. Absence of a marker is not proof of safety — compressed object streams, encrypted content, filters, incremental revisions and malformed syntax can all hide cues from a lexical pass. Treat a clean result as one weak signal and use a real antivirus or sandbox for a verdict.
The markers that let a document act on its own: /OpenAction and /AA fire an action when the file is opened or on an event, /JavaScript carries script, /Launch attempts to start an external program, /SubmitForm can send form data outward, and /EmbeddedFile carries another file inside the PDF.
Up to 20 MB, and the file must contain a %PDF- header within its first 1,024 bytes. Scanning also stops at 450,000 tokens, and a warning is shown when that ceiling truncates the counts.
No. Marker presence says nothing about intent, reachability or whether your viewer would even run it — form validation, calculated fields and accessibility features legitimately use these names. It tells you the file deserves a closer look, not that it is dangerous.