Strip JavaScript
Remove JavaScript is ticked by default. A PDF can carry scripts that run when the file is opened or a form is used, and this box asks the engine to take them out. Show JavaScript lists the embedded scripts if you want to look first.
No file open
Sanitize PDF
or drop a file anywhere here
Dropbox
Google Drive
Files other than PDF are converted first. Signing in raises the size limit.
Or start from a blank IRS form
Browse all IRS forms →- You add
- One PDF
- You set
- Five checkboxes for what to remove
- You get
- A sanitized copy of the PDF
Sanitizing a PDF means stripping out parts of the file that can run code, carry extra files or reveal details about the document. This page offers five removals as checkboxes: Remove JavaScript, Remove embedded files, Remove metadata, Remove links and Remove fonts. The first two are ticked when the page opens and the other three are not. indox passes your choices to its PDF engine and returns the result as a new PDF. The tool carries the Pro badge in the indox catalog. It does not report what it found or removed, so this page also shows how to inspect a file with other indox tools.
What can you do when you sanitize a PDF?
Drop embedded files
Remove embedded files is ticked by default too. It targets files attached inside the PDF, such as a spreadsheet tucked into a report. List Attachments shows what is embedded, and Extract Attachments saves those files before you strip them.
Clear metadata when you choose to
Remove metadata starts unticked, so a default run leaves the document details in place. Tick it when those details should not travel with the file. To change them instead, Edit PDF Metadata sets the title, author, subject and keywords.
Remove links or fonts with care
Remove links and Remove fonts stay off until you tick them. Links are how a reader jumps to a site or another page, and fonts hold the letter shapes that text is drawn with, so read the whole result after you use either box.
What sanitizing keeps and what it changes
Stays the same
- Page text and images, whichever boxes you tick.
- Page order and page count.
- XMP metadata. The page has no box for it, so it is not removed.
- The file on your device. You download a cleaned copy.
Changes
- Remove JavaScript: clears the document-level script list, the open action when it is a script, and script actions on pages, form fields and form widgets.
- Remove embedded files: clears the list of embedded files and deletes file-attachment annotations from the pages.
- Remove metadata: replaces the document information (title, author and similar fields) with an empty set.
- Remove links: clears the web and launch actions on link annotations, so a link no longer opens anything.
- Remove fonts: deletes the font entries from each page's resources, so text may stop displaying.
Which boxes for which job
| You want to | Tick | Check after |
|---|---|---|
| Send a form or report without scripts | Remove JavaScript | Open the result and use any form fields once. |
| Share a PDF without files tucked inside it | Remove embedded files | Use List Attachments on the result to see that none are left. |
| Share a PDF without the author and title fields | Remove metadata | Open Document Properties in a viewer. XMP metadata is not touched by this page. |
| Make links inert | Remove links | Click a link in the result. |
| Strip every optional part | All five | Read every page. Without fonts, text may not show. |
How to sanitize a PDF in 3 steps
Add the PDF to sanitize
Drop one PDF on the upload box or press Choose file. Use Replace on the file card if the wrong document is showing.
Tick what to remove
Keep Remove JavaScript and Remove embedded files ticked, or clear them. Tick Remove metadata, Remove links or Remove fonts if you want those gone as well.
Run Sanitize PDF and download
Press Run Sanitize PDF. When the result card appears, choose Download and open the copy to confirm it still reads correctly.
Why sanitize a PDF with indox?
Each removal is its own checkbox, labeled with the thing it removes, so you can see what a run will ask for before you start it. The two defaults cover scripts and attached files, and the other three stay off until you decide you need them. If the PDF engine is unavailable or reports an error, the job fails with a message and does not hand your original back marked as done. Your PDF reaches indox over an HTTPS connection. This page does not claim that a sanitized file is safe to open.
- Five removals, each with its own checkbox
- JavaScript and embedded files ticked by default
- Metadata, links and fonts left for you to choose
- A failed job shows an error, not a file
- Files travel over HTTPS
What are the limits when you sanitize a PDF?
- Size
- The free tier has a file size limit. Signing in raises it, and paid plans raise it further.
- Formats
- This tool works on PDF files. To change a file's type, use the PDF converter.
- Privacy
- Files are encrypted in transit and processed on indox infrastructure.
- Deletion
- Free-tier files are deleted automatically within 24 hours after the job finishes. Signed-in output stays in your history for your plan's retention period.
Limits worth knowing
- The tool removes only what the five boxes name. It has no setting for form fields, comments or hidden layers.
- indox runs no virus scan on the file and does not report what was removed. A sanitized PDF is not proof that a file is safe to open.
- Remove metadata is off by default. A run with the starting boxes leaves the stored document details in the file.
- Fonts hold the letter shapes for the text, and the page has no preview. Keep the original until you have read a copy made with Remove fonts.
- This page cannot take a password. Take the protection off a locked PDF with Unlock PDF, then sanitize the unlocked copy.
When the result is not what you expected
| What you see | Why | What to do |
|---|---|---|
| The text vanished or looks wrong | Remove fonts deleted the font entries the text draws with | Run the original again with Remove fonts unticked. |
| The author and title are still there | Remove metadata is off by default, and XMP metadata is never touched here | Tick Remove metadata. To set new values instead, use Edit Metadata. |
| A form field no longer does anything | Remove JavaScript clears scripts that fields use for checks and calculations | Run again with that box unticked, or fill the form first with Fill PDF Form. |
| You want to read the scripts before they go | The job gives no list of what it removed | Look first with Show JavaScript. |
| The file asks for a password | The page has no field for one | Remove it with Unlock PDF, then sanitize the open copy. |
What do the free and paid plans add?
Free
- All converters
- Daily credit refresh
- Email support
Basic
- Access to all features
- AI Extract
- Priority conversions
- Email support
Highest priority
Premium
- Everything in Basic
- Highest priority queue
- Larger file limits
- Priority support
Pay-As-You-Go
- No subscription
- Credits never expire
- Opt-in auto-refill
- Access to all features
What else can you do with a PDF?
Who sanitizes PDFs?
People who receive PDFs from outside
A file arrives from an unknown sender or an old archive. Strip its scripts and attachments before you pass it to colleagues, and still treat it with care.
Teams publishing documents
A report is about to go on a website. Tick Remove metadata as well, so the job also asks for the stored document details to be removed from the published copy.
Administrators with upload rules
A portal or records system refuses PDFs that contain scripts or attachments. Run the file here, then confirm with Show JavaScript and List Attachments before you submit it.
When to sanitize, and when to pick another tool
- A PDF from outside your organization is going to be forwarded, and its scripts and attachments should not go with it.
- A document is being published and its stored details should be stripped first.
- An intake system rejects files with embedded attachments or JavaScript.
- You want to hide words on the page. None of the five boxes covers visible text, so use Redact Text for that.
- You want to stop people opening the file at all. Protect PDF adds a password, which sanitizing does not.
Where can I read more?
Sources
- SanitizeController source, v2.14.2Stirling-PDF on GitHub
- Stirling-PDF documentationStirling-PDF
Facts checked on October 16, 2026
Do it all with indox
No tool matches that search.
Sanitize PDF FAQs
What does Sanitize PDF remove by default?
JavaScript and embedded files. Those two boxes are ticked when the page opens. Metadata, links and fonts stay in the file unless you tick their boxes.
Does sanitizing make a PDF safe?
It asks for the kinds of content you ticked to be removed, and that is all the tool does. It gives no verdict on the file, so keep your usual care with documents from unknown senders.
How can I check what was removed?
The tool gives no report. Run Show JavaScript and List Attachments on the original and again on the download, then compare the two results.
Will sanitizing change how my PDF looks?
The default boxes target scripts and attachments, not page content. Remove links and Remove fonts act on things a reader uses or sees, so read the result through if you tick them.
Is the metadata removed?
Only if you tick Remove metadata. The box is clear when the page opens, so a first run with the starting settings does not ask for metadata to be removed.
What happens if I untick every box?
The job is still sent to the engine with every removal switched off, so do not expect anything to be stripped. Nothing on the page stops you.
Is Sanitize PDF a Pro tool?
It carries the Pro badge in the indox tool catalog, where the badge filter reads Pro / Dashboard. Use See prices further down this page for the current plans.
What happens when the job fails?
You see an error and a Try another button, and no file is produced. indox does not return the original PDF as if it had been sanitized.