PrivatePDF

Check the links in a PDF

A link in a PDF can say one thing and do another. The text reads “www.yourbank.com” and the link underneath goes somewhere else entirely — which is exactly how a phishing document works, and exactly what is hard to see by hovering over it in a viewer that shows the address in small grey type. This lists every link in a PDF with the page it is on and where it actually goes, and flags the ones whose visible text names a different site from their real destination. It reads the links without visiting any of them, in your browser, so the document is never uploaded.

or drop a file anywhere on this panel

opened locally · 0 bytes sent

How it works

  1. 01Open the PDF.
  2. 02Read the list — every link, its page, and where it goes.
  3. 03Check any warning: a link that shows one site and goes to another, or one that opens a program.
  4. 04Export with all links removed, if the document is going somewhere its links should not follow.

What it compares, and why that works

For each link it reads two things: the address the link actually opens, and the text a reader sees where the link sits on the page. When the visible text is itself a web address, the two are compared by site. A link that shows paypal.com and goes to checkout.paypal.com is fine — that is the same company. One that shows paypal.com and goes to paypal.com.evil.example is not, and it is caught, because the comparison is made on the whole name rather than on how it begins. Lookalike names using letters from other alphabets are compared in their encoded form, so they do not pass for the real thing either.

Links that are not links

A PDF link does not have to open a web page. It can launch a program on the reader’s computer, open a file, or run a script, and none of that is visible until someone clicks. Those are listed separately and flagged. Every export from this site removes them regardless of which tool you use, while keeping ordinary web links and jumps between pages.

It never visits anything

Checking whether a link works would mean requesting it — which tells the site behind it that the document was just opened, and by roughly whom. For a suspicious document that is exactly the wrong thing to do. So this reads the links from the file and nothing more; no address in the document is ever contacted.

Addresses written as text

A web address can also appear as plain text with no link at all, and many viewers turn it into something clickable anyway. Those are counted too, so the list does not quietly miss what a reader can click on. Removing links does not change them, because they are part of the text.

Questions

Does it test whether the links work?
No, deliberately. Testing a link means visiting it, which announces to the site behind it that this document was opened. For a document you are suspicious of, that is the last thing you want.
Can it tell me whether a site is dangerous?
No. It shows you where each link goes and flags the ones that disguise their destination, which is the part a document can hide from you. Whether a destination is trustworthy is a judgement about the site, not the file.
Will removing links change how the document looks?
Only for a link drawn with a visible border, which disappears with it. The text a link sat over always stays.
Is the document uploaded?
No. The links are read by your own browser, and nothing in the document is contacted.