01What a PDF can carry
Scripts and actions
JavaScript in the document, and on open, close, save, print and page events, links, bookmarks and fields. A script can open a web address, send the form or an email, connect to the internet, read or write files, print, run on a timer, or build code as it goes. Some actions run by themselves: when the document opens, closes or prints, a page opens, or the pointer passes over.
Addresses and files it reaches
Every web address, mail address, file and program the document can reach: links, bookmarks, Submit and Launch actions, other PDFs, addresses inside scripts, and data streams kept outside the file.
Attachments
Files attached to the document or to a page, associated files and portfolios, including zipped Office files and PDFs inside the PDF.
Metadata
Document properties (author, title, subject, the software that made it), XMP metadata of the document and of pages, pictures and fonts, other apps' private data, and comment authors with their dates.
Earlier versions
A PDF saved incrementally appends its changes and keeps the old content. Each earlier version can be opened on its own, with the text its pages showed that the current ones don't.
Hidden content
Hidden layers, hidden comments and fields, text drawn in white or outside the page, and text and pictures under covers that hide nothing. Form values, and the signatures on the file: who, when, why, where.
02See it: What's in This PDF
- Open the PDF and choose Review › What's in This PDF…, or type "what's in" in the command palette (Ctrl+K). The report is also a button in Document Properties and in Sanitize Document.
- Read the report: one list of everything above, grouped by kind. Each script says where it runs and what it calls that reaches outside; each address is marked when it is reached without a click; each earlier version shows the text it had that the current one doesn't.
- Each row says whether Sanitize removes it. Go to page scrolls to the item on the page.
- Save Report writes it as one web page (no scripts) or as JSON; Copy Report puts it on the clipboard as text.
Nothing in the file is opened or contacted while the report is made: scripts are read, not run; addresses are listed, not visited; attachments are inspected, not opened.
03Remove it: Sanitize Document
Review › Sanitize Document removes what a document carries besides its pages. The dialog counts what it found, one check box per kind, all on: metadata (and the file identifier is made new, so the copy can't be matched to the original); hidden layers with what they draw, cut out of the content rather than switched off; hidden comments and fields; comments; form field values; bookmarks; thumbnails; JavaScript and the open, Launch, Submit and Import actions; multimedia and XFA forms; links to web pages and other files; attached files; and, on a signed file, its signatures. The file is rewritten as one version, so earlier versions and unused objects are gone too. Afterwards the result is read back and scanned again, and anything left is listed. One undo step; a protected file keeps its protection.
A signed file's signatures no longer verify after Sanitize, and the dialog says so. Sanitize before signing, or keep the signed original and sanitize a copy to share.
04Text under black boxes
The report's last section is the redaction check's own findings: text and pictures under covers that hide nothing. A box drawn over a name with a shape or comment tool leaves the name in the file. Redact a PDF for free, and check that it's really gone covers redaction, Redact by Pattern and Check Redaction, which looks at any PDF, including one redacted elsewhere.
05Many files at once
On Windows, Batch has both as actions. Report What's in Each File writes "name contents.html" and ".json" beside each file; Sanitize cleans each file into the output folder, never replacing the originals; Check Redaction fails any file with something recoverable left. A preset saves the list of actions, a watched folder runs it on every file dropped in, and inkvoltpdf --batch runs it from a terminal or a scheduled task.
06
On the Mac
Inkvolt PDF for Mac (1.2 and later) has Tools › What's in This PDF… and See What's in It… in Sanitize Document, with the same report, saved as a web page or JSON, and Sanitize Document itself (1.1 and later). It is a notarized download for Macs with Apple silicon on macOS 15 or later: download the disk image, or brew install --cask gabandres/inkvolt/inkvolt-pdf.
07Questions
Can a PDF contain a virus or run code?
A PDF can carry JavaScript and actions that open web addresses or launch programs. Whether anything happens depends on the viewer. What's in This PDF lists every script and action, what it calls that reaches outside, and when it runs, without running any of it.
Does a PDF keep earlier versions of itself?
Often. Saving incrementally keeps the old content in the file, so text you deleted or redacted may still be there. The report shows each earlier version with the text it showed; Sanitize rewrites the file as one version.
What metadata does a PDF carry?
Document properties, XMP metadata of the document, pages, pictures and fonts, comment authors and dates, and other apps' private data. Sanitize removes them and makes the file identifier new.
Does What's in This PDF send the file anywhere?
No. The report is made on your PC or Mac, and nothing in the file is opened or contacted. Inkvolt PDF has no cloud service, no account and no telemetry; the privacy policy is the whole list of what it does online, each on your action.
Is it free?
Yes, on Windows and Mac, like Sanitize and the redaction check. It is part of the privacy promise and will stay free when Inkvolt Pro opens.