BASALT · JOURNAL
How to remove JavaScript and actions from a PDF
PDFs can contain active behavior as well as pages. JavaScript may validate forms or calculate fields, while actions can open URLs, launch files, navigate, submit data, or run when a document opens or closes.
Where active content can live
Inspect the document catalog for open actions and name-tree JavaScript, page-level additional actions, annotation and link actions, AcroForm field events, and embedded files used by launch actions. Looking only for a .js attachment is insufficient.
Not all actions are malicious. A table-of-contents link is an action too. A release policy should distinguish harmless internal navigation from network, launch, submit, and script behavior, or remove all active content when interactivity is unnecessary.
Remove dependencies deliberately
Deleting a script can break calculations, validation, or dynamic form behavior. If the recipient only needs a record, render the final approved field appearances, clear interactive values and actions, and produce a static derivative. Preserve the functional original separately when required.
Dynamic XFA forms need special care because their appearance may be generated by scripts. Convert them to an ordinary static PDF only after confirming that all intended values and pages rendered.
Verify the static copy
Enumerate scripts and actions with a parser independent of the writer. Check that no open, launch, submit, URI, or JavaScript actions remain under the policy and that embedded files are absent. Open the document with networking disabled and confirm the pages still communicate the intended record.
Frequently asked questions
Can a PDF run JavaScript automatically?
Yes. Scripts and actions can be associated with document-open, page, annotation, and form events, subject to viewer security controls.
Will printing to PDF remove scripts?
It may create a static page representation, but behavior and retained metadata vary. Inspect the result rather than assuming.
Can removing JavaScript break a form?
Yes. Calculations and validation may depend on it. Render and review the completed appearance before creating a static release copy.
Doing it in Basalt
Basalt inspects and removes JavaScript, actions, attachments, and interactive form data while preserving a reviewed static appearance. Its verifier checks that active content is absent, and the engine itself has no network entitlement. Get Basalt.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.