PDF Analyzer

No. The PDF Analyzer runs entirely in your browser using local JavaScript and built-in web APIs. Your file is read into memory on your own device, analyzed there, and never transmitted to any server. You can even disconnect from the internet after the page loads and it will still work.

It can surface the things that make a PDF risky: embedded JavaScript, automatic launch actions (OpenAction), embedded files and attachments, and external links. These are the mechanisms most commonly abused in malicious documents, so seeing them flagged is a strong signal to be cautious. However, the analyzer only detects and reports — it never executes any script or opens any attachment, and it is not a substitute for a full antivirus engine. Treat it as a triage tool for deciding whether a file is safe to open.

That happens when the PDF is encrypted. In an encrypted PDF the string values in the document information dictionary — title, author, subject, and so on — are stored as ciphertext. Reading them would require the document's password, which the tool never asks for. The structural information (version, object counts, encryption method, permissions) is still reported because that part of the file is not encrypted.

PDF version 1.5 and later store most objects inside compressed object streams using the FlateDecode (zlib/deflate) filter. Modern browsers ship a native DecompressionStream API that can inflate deflate data with no external dependency. The analyzer uses it to decompress those streams, then scans the decompressed content for fonts, images, scripts, and links — so it can see just as deeply into a compressed PDF as into an old-style uncompressed one.

Embedded means the actual font program is stored inside the PDF, so the document displays identically on any device — important for print and archival. If a font is not embedded, the reader substitutes a similar installed font, which can shift the layout. Subset means only the specific characters used in the document were embedded (the font name is prefixed with a tag like ABCDEF+), which keeps the file smaller while still guaranteeing correct rendering.

Password-protected (encrypted) files are analyzed for everything except their encrypted string values, as described above. Truncated or slightly malformed files usually still yield partial results — the analyzer reads whatever structure it can find. A file that is not a PDF at all (no %PDF- header) is rejected with a clear message.

For the overwhelming majority of PDFs, yes. The page count is derived from the page objects declared in the file structure, cross-checked against the /Count value on the page tree. Deliberately obfuscated or badly broken files can occasionally report an approximate number, which is why the count is presented alongside the rest of the structural evidence rather than in isolation.