pdfcosmos

Check PDF Security

See what's hidden inside a PDF before you share it: a read-only privacy report.

Free, fast, and privacy-first.

Check a PDF's security

or drag & drop files here

PDF files onlyone file at a timeup to 100 MB each

Check a PDF's security — see what's hidden before you share it

Check PDF Security is a read-only inspector: it opens your PDF and reports what's inside beyond the visible pages — whether it's encrypted or password-protected, whether it contains JavaScript, whether it carries embedded files (attachments), interactive form fields, annotations or links, and what metadata it stores about the author, software, and dates. Nothing is changed; you get a plain report (and a downloadable .txt summary) so you can see exactly what you'd be handing over.

A “found” result doesn't mean a PDF is dangerous — scripts, forms, and metadata are normal in many documents — it just tells you what's there so you can decide. Each finding links straight to the tool that removes it (Unlock, Remove JavaScript, Remove or Extract Attachments, Remove Metadata, Remove Annotations, or Sanitize for several at once), so you can clean up and re-run the check to confirm. The whole inspection runs in your browser with pdf.js, so your file is never uploaded and never leaves your device.

  • Read-only, nothing changed

    It reports what's inside and leaves your file exactly as it is.

  • Sees the hidden layers

    Encryption, JavaScript, attachments, form fields, annotations, and metadata.

  • Links to the fix

    Each finding points to the tool that removes it — or Sanitize for several at once.

  • Runs on your device

    pdf.js inspects in your browser. Your file is never uploaded.

How to check a PDF's security

  1. Add your PDF

    Click “Add PDF”, or drag a single file into the upload area.

  2. Run the check

    Click “Check security”. The PDF is inspected in your browser. Nothing is uploaded or changed.

  3. Review the report

    See what's inside (encryption, scripts, attachments, forms, annotations, and metadata) and jump to the tool that removes anything you don't want.

Frequently asked questions

Is my PDF uploaded to a server?
No. The PDF is inspected entirely in your browser using pdf.js. Your file never leaves your device, and nothing is changed. You can confirm it in your browser's Network tab: no file data is sent.
What does it check?
Whether the PDF is encrypted or password-protected, whether it contains JavaScript, whether it has embedded files (attachments), interactive form fields, annotations or links, and what metadata it stores (author, software, dates). It's a read-only report. It doesn't modify the file.
Does a “found” result mean the PDF is dangerous?
Not necessarily. Scripts, forms, and metadata are normal in many PDFs. The report just tells you what's there so you can decide. For example, you might strip the metadata and scripts before sharing a document publicly. Each finding links to the tool that removes it.
It says the PDF is password-protected. Why can't it check the rest?
A PDF that needs a password to open can't be read until it's unlocked, so its contents can't be inspected. Unlock it first with Unlock PDF (using the password), then run the check again.
How do I remove what it finds?
Use the linked tools (Remove JavaScript, Remove Attachments, Remove Metadata, or Remove Annotations) or Sanitize PDF to strip several at once. Then re-run the check to confirm.