A PDF parser reads the object structure of a PDF file — its numbered objects, content streams, cross-reference table and trailer — exposing the document's internal composition rather than its rendered appearance.
What is the PDF Structure Parser?
A PDF is a graph of numbered objects, not a linear document. Dictionaries, arrays, streams and references point at one another; the cross-reference table at the end maps object numbers to byte offsets, and the trailer points at the catalog that roots the whole tree. Content streams — the drawing instructions for each page — are almost always FlateDecode-compressed, which is why a PDF opened in a text editor is mostly unreadable binary.
The structure is where the interesting things hide. Incremental updates append new objects without removing the old ones, so 'redacted' or edited content frequently remains intact earlier in the file. /JavaScript, /OpenAction and /Launch entries are the classic malicious-PDF indicators. Embedded files, form data and XMP metadata all sit in identifiable objects.
Parsing structure rather than rendering the document is also the safe way to examine a suspicious PDF: no fonts are loaded, no scripts run, and nothing is executed.
How to use the PDF Structure Parser
- Load the PDF — it is parsed in your browser and never uploaded.
- Browse the object tree, the trailer and the cross-reference entries.
- Inflate content streams to read them, and check for JavaScript or embedded files.
When to use it
- Examining a suspicious PDF attachment without opening it in a viewer.
- Recovering content that an incremental update left behind after an edit.
- Debugging a generated PDF that a strict viewer refuses to open.
PDF Structure Parser at a glance
| Header | %PDF-1.x in the first bytes |
| Structure | Numbered objects, xref table, trailer, catalog |
| Streams | Usually FlateDecode — inflate to read |
| Risk markers | /JavaScript, /OpenAction, /Launch, /EmbeddedFile |
Frequently asked questions
Why is a PDF unreadable in a text editor?
Content streams are compressed, normally with FlateDecode. The object structure around them is text, but the drawing instructions and embedded images are binary until inflated.
Can deleted content be recovered from a PDF?
Often. PDFs support incremental updates that append changes rather than rewriting the file, so earlier versions of objects — including text someone believed they had removed — frequently remain present.
How do I tell if a PDF is malicious?
Look for /JavaScript, /OpenAction, /Launch and /EmbeddedFile entries, and for objects with obfuscated names or unusual filters. Structural inspection is safe; opening it in a reader is what you are trying to avoid.
Last reviewed · found a mistake? contact@decoder.tools · view as markdown