Metadata, comments, attachments, scripts: the sanitize pass that shows you first
A PDF carries more than its pages — author fields, comments, attachments, scripts, hidden text. Sanitize PDF reports it, strips your ticks, re-checks.
UnboundPDF is a free suite of 48 PDF and image tools that run entirely in your browser — merge, split, compress, edit text, OCR in 126 languages, redact, sign, convert and archive to PDF/A. Your document is read and written by the page on your own device; there is no document-upload endpoint in the core tools, no account, no watermark and no daily cap. Every result can be checked — with the Network tab, or with the Document Passport the Workspace writes for a chain of steps.
Quick start. Open Sanitize PDF, add the file, read the findings report — six classes, counted — tick what should go, download, and read the check made on the output bytes. Ninety seconds for most documents.
The invisible cargo
Every PDF is a container, and containers accumulate: an Author field with your real name and the software licence it registered, the review thread nobody deleted, an embedded attachment from three versions ago, document JavaScript, form fields still holding a previous applicant's values, and — the treacherous one — text that is in the file but painted invisibly. All of it travels with every copy, to every recipient, forever.
Report first, then your call
The tool's order matters: findings before actions. You see what the file carries before deciding — because a comment thread might be the deliverable, and a form's values might be the point. That is why the defaults are conservative (metadata, scripts, attachments on; comments and form values off) and why hidden text gets flagged with no checkbox at all: stripping it blindly would break every searchable scan, so the row routes to Redact PDF instead. The manual routine taught this; the tool now performs it.
A check you could read aloud in a meeting
After the strip, independent code re-reads the saved bytes and reports per class: checked and no longer present — or still present, named per page. The vocabulary is deliberate: never "clean", never "safe", because no automated check can promise that. What it can promise is exactly what it verified, which is the only promise worth forwarding. Pair with redact-then-protect when the content itself needs removing too.
Troubleshooting
The report found hidden text on a scan. Probably its OCR layer — that is why it is flagged, not auto-removed. Check it; keep it if it is your searchable text. A class reads "not fully checked". Honest scope: some constructions are outside the check's reach and the tool says so rather than claiming a pass. I need metadata kept but attachments gone. That is just the ticks — the defaults are suggestions, not policy.
Frequently asked questions
Is this redaction?
No — and the tool says so on its face. Sanitising removes what rides alongside the pages; visible content is redaction's job, one link away.
What's on by default?
Metadata, scripts and attachments. Comments and form values wait for your tick, because they are often the document's substance.
How do I know the strip worked?
The saved output is re-scanned by independent code and the result names, class by class, what is no longer present — and anything that survived, per page.
Try it yourself
Free, private, no account. Runs entirely in your browser.
