Why is a PDF unreadable in a text editor?

Content streams are compressed, normally with FlateDecode. The object structure around them is text, but the drawing instructions and embedded images are binary until inflated.

Can deleted content be recovered from a PDF?

Often. PDFs support incremental updates that append changes rather than rewriting the file, so earlier versions of objects — including text someone believed they had removed — frequently remain present.

How do I tell if a PDF is malicious?

Look for /JavaScript, /OpenAction, /Launch and /EmbeddedFile entries, and for objects with obfuscated names or unusual filters. Structural inspection is safe; opening it in a reader is what you are trying to avoid.

PDF Structure Parser

Walk PDF objects, streams and the cross-reference table.

on the roadmapFile Format & Archivesfree · no sign-up

This bench is being wired up

The pdf-parser decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the PDF Structure Parser?

A PDF parser reads the object structure of a PDF file — its numbered objects, content streams, cross-reference table and trailer — exposing the document's internal composition rather than its rendered appearance.

A PDF is a graph of numbered objects, not a linear document. Dictionaries, arrays, streams and references point at one another; the cross-reference table at the end maps object numbers to byte offsets, and the trailer points at the catalog that roots the whole tree. Content streams — the drawing instructions for each page — are almost always FlateDecode-compressed, which is why a PDF opened in a text editor is mostly unreadable binary.

The structure is where the interesting things hide. Incremental updates append new objects without removing the old ones, so 'redacted' or edited content frequently remains intact earlier in the file. /JavaScript, /OpenAction and /Launch entries are the classic malicious-PDF indicators. Embedded files, form data and XMP metadata all sit in identifiable objects.

Parsing structure rather than rendering the document is also the safe way to examine a suspicious PDF: no fonts are loaded, no scripts run, and nothing is executed.

PDF Structure Parser at a glance

Header: %PDF-1.x in the first bytes
Structure: Numbered objects, xref table, trailer, catalog
Streams: Usually FlateDecode — inflate to read
Risk markers: /JavaScript, /OpenAction, /Launch, /EmbeddedFile

How to use the PDF Structure Parser

1Load the PDF — it is parsed in your browser and never uploaded.
2Browse the object tree, the trailer and the cross-reference entries.
3Inflate content streams to read them, and check for JavaScript or embedded files.

When you would reach for it

Examining a suspicious PDF attachment without opening it in a viewer.
Recovering content that an incremental update left behind after an edit.
Debugging a generated PDF that a strict viewer refuses to open.

PDF Structure Parser — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools