BASALT · JOURNAL
Can a PDF be tracked? What a file can report back when opened
A PDF can't report back on its own. It's a file of data, and it has no way to phone anyone unless the program reading it makes a network request on its behalf. A plain PDF opened in a reader that doesn't act on its links, forms or scripts sends nothing.
That's the narrow answer. The wider one is that a PDF can contain instructions a reader might follow, and that much of the tracking people run into happens around the file: in the web page that showed it, or the email that carried it. Knowing which is which tells you what to check, and what checking can't tell you.
What a PDF can ask a reader to do
The standard lets a file hold actions, and a handful of them point at the network. Each one needs the reader to cooperate.
- A link to a web address. A URI action opens an address. On a link, nothing happens until someone clicks. If the address includes an identifier, whoever runs that server can see that the identifier was requested.
- A form submission. A SubmitForm action sends form data to a URL, normally when you press a button.
- A link to another file. A GoToR action opens a different PDF, and a Launch action opens a file or an application.
- JavaScript. A file can carry scripts, and a reader that runs them could in principle make requests.
Any of these can also be tied to an event instead of a click. The /OpenAction entry in the catalog names an action to perform when the file opens, and /AA entries hold actions for events such as a page opening. Whether a reader carries one out, asks you first or ignores it is the reader's decision, not the file's.
The simplest pattern is the first one: a link with a per-recipient identifier in the address. It reveals a click, not an open.
Where tracking usually happens instead
A file you receive as an attachment has no way to count its own opens. When people say a PDF was tracked, the signal often came from somewhere else.
One place is a document-sharing service that shows the file in a web page. The page can record that someone viewed it, because the viewing happens on the service's server and not inside the PDF. The PDF you download from that page has no connection back to it, apart from any links inside.
Another is the email that carried the file. A message can contain its own tracking, separate from the attachment, and it can include a link to download the PDF from a server that counts requests. In that case it's the download that was logged, not the opening.
So if you're hoping to see when someone opens a PDF you sent, the file alone won't tell you. If you're the recipient wondering about a file you were sent, the file's contents are what you can check, and the delivery path you can't.
How to check a PDF on a Mac
Make an uncompressed copy of the file so its actions are searchable. This needs qpdf, from brew install qpdf, and it writes a new file without changing the original. Then list which action keywords appear, and how often:
qpdf --qdf --object-streams=disable document.pdf expanded.pdf
grep -a -o -E '/(JavaScript|JS|OpenAction|AA|Launch|URI|SubmitForm|GoToR|EmbeddedFile)\b' expanded.pdf | sort | uniq -cEach line shows a keyword and how many times it appears. For a sample file with one link, a script set to run on open, a submit action and a link to another PDF, the output on macOS 15 listed /GoToR, /JavaScript, /JS, /OpenAction, /SubmitForm and two /URI. A /URI count is double the number of links, because the keyword appears once as the action type and once as the key holding the address.
Expanding first matters. Since PDF 1.5, dictionaries can sit in compressed object streams, so a raw search of the original can miss them. Then read the addresses themselves:
grep -a -o -E '\((https?://[^)]*)\)' expanded.pdfThat prints every web address written in parentheses, whether it belongs to a link, a form submission or a remote file. On the sample file it listed three: the link's, the form's and the remote PDF's. Read them like any link you'd get in a message: a long string of random-looking characters after a question mark is often an identifier, and a domain you don't recognize is worth a pause.
What the check can't tell you
A clean result means the file has no action that names a web address in the form searched for. It doesn't prove that nothing else is there. Scripts can build addresses from pieces, so a /JavaScript hit is a reason to read the script, not to conclude it does anything. A /URI hit is usually just a link, because most documents have some.
Equally, a search can't see the path the file took to you. Whether a PDF can carry a virus covers the safety side of the same questions, and checking a PDF for JavaScript on a Mac goes further into scripts.
What to do about it
Don't click links in a file you don't trust, and don't press its form buttons. If a file carries JavaScript you don't want, removing JavaScript from a PDF covers how. If you're sending a file and want it to leave no hint of its origin, remember that a PDF's metadata and hidden content can identify a source even though it can't report on its own. For documents you'd rather not upload anywhere, the risk of cloud PDF tools is the other side of the same question.
Frequently asked questions
Can you see who opened a PDF?
Not from the file itself. A PDF has no log of who opens it and no way to send one. If you can see opens, the view happened on a server you control, such as a web page that displays the file, or a link in the document that someone clicked. The file you emailed can't tell you.
Can you track when a PDF is opened?
Not with a plain PDF. Opening a file only reads it on the reader's own computer. Through its /OpenAction entry, a file can ask for a script to run or a web address to open as soon as it's opened, but what happens next depends entirely on the reader, so it isn't a dependable way to count opens.
Can a downloaded PDF be tracked?
The download can be logged by the server that sent it, and a link inside the file can report a click later. The saved file itself can't report back by itself. Once it's on your disk, anything it sends must come from an action the reader performs, usually one you started by clicking a link.
Can you tell if a PDF has been opened?
Not from the PDF. It has no counter and no record of who read it, and nothing in your copy changes when someone opens theirs. If a sender says they saw you open a file, the signal came from a web page that showed it, a link you clicked or the email that carried it.
Can a PDF link track me?
A link with an identifier in its address can show the server that the identifier was requested when you click it. It can't show a click you didn't make. Before clicking a link in an unfamiliar file, read the address with the grep command above and decide whether you trust the domain.
Does a PDF phone home when I open it?
A plain document doesn't. A file can hold an action that names a server and is set to run on open, but whether anything goes out depends on the reader, which may run it, ask you first or ignore it. The search above shows whether such an action is in the file.
What does /SubmitForm do in a PDF?
It's an action on a form button that sends the form's data to a web address, typically when you press the button. The data goes only where the address in the file says, and only if the reader supports the action and you trigger it. Check the address in the file before you press Submit.
Doing it in Basalt
Basalt has an Inspect tool that reports whether a PDF contains JavaScript, along with embedded files, annotations, form fields and other things that travel off the page. It doesn't list links or web addresses, so use the commands above for those. The more relevant point is the way Basalt opens documents: a separate engine process does it, and that process has no network entitlement, which macOS enforces at the code-signature level. A file opened by that engine can't make a network request of its own, whatever actions it carries. The app itself goes online only to check the license, with no account and no telemetry. Basalt is $29 once for up to three Macs, free for 24 hours, and every tool writes a new file.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.
