PrivatePDF

Get the files embedded in a PDF

A PDF can carry other files inside it, and most people have never been told this is possible. Sometimes that is the whole point of the document — an electronic invoice is a PDF with the machine-readable invoice embedded as XML, and getting that XML out is what you are there for. Sometimes it is the opposite, and the embedded file is something you did not expect and should treat with suspicion. This finds them either way, tells you what they are, and lets you take them out — in your browser, without handing an unknown file to a server.

or drop a file anywhere on this panel

opened locally · 0 bytes sent

How it works

  1. 01Open the PDF.
  2. 02Read the panel — it lists what is embedded before you extract anything.
  3. 03Decide whether you actually want it. An unexpected embedded program is a red flag.
  4. 04Download. One file comes out on its own; several come out as a zip.

Treat what comes out like an email attachment

This is the part worth saying twice. An embedded file was put inside the document by whoever made it, it is invisible in every PDF viewer until something opens it, and that combination is a well-established way of delivering malware. The panel flags an embedded program specifically, because a .exe or .js inside a PDF is almost never something you asked for. Extracting writes the file to your computer; if you did not expect it, the right move is not to.

Electronic invoices are the ordinary case

Factur-X, ZUGFeRD and PDF/A-3 all work by embedding a structured file — usually XML — alongside the human-readable pages. Accounting systems read the embedded copy; people read the pages. If someone has sent you an invoice your software will not ingest, the XML inside it is what you need, and this will get it for you.

It looks in all three places files hide

Attachments reach a PDF by three different routes: the document-level embedded-files list, a paperclip annotation sitting on a page, and the associated-files array that electronic invoices use. Tools that only check the first miss the other two. This reads the document’s objects directly and finds all three, and a file attached through more than one route is extracted once rather than duplicated.

Filenames are made safe before anything is written

The name of an embedded file is chosen by whoever built the PDF, and a name like “../../.ssh/authorized_keys” is perfectly legal. Fed to a careless archive extractor, that writes outside the folder you extracted into. Every name is stripped to its last component, cleared of characters your filesystem rejects, and replaced entirely if nothing sensible is left — so what lands on your disk goes where you told it to.

Questions

How do I know a PDF has files inside it?
Open it here, or use the inspector, which counts embedded files along with everything else hidden in a document. No mainstream viewer tells you.
How do I remove the attachments instead?
Export a PDF from any tool here. The export rebuilds the document from its pages, so embedded files, scripts and document-level metadata are dropped automatically.
Is it safe to extract something suspicious?
Extracting writes the file to your computer, which is the same risk as saving an email attachment — the danger is in opening it afterwards. If you do not know why a document contains a program, do not extract it.
Is the document uploaded?
No, and here that matters more than usual: the documents people most want to inspect for hidden files are exactly the ones they should not be sending to a stranger’s server.