Extract PDF Attachments

Features

• Lists every embedded attachment with its file name, size and description
• Exports each one as a file, served as binary (no hint to the browser that it might be renderable)
• ⚠️ Flags executables and scripts, including double-extension disguises like `invoice.pdf.exe`
• An attachment whose content cannot be read still appears in the listing, rather than quietly going missing
• The listing can be copied in one click, for records or to pass on
• Read-only throughout: attachments are never executed or opened
• Nothing is uploaded and no server is involved

How to use

1. Drop in the PDF you want to inspect
2. The first card is the listing; each attachment then gets its own card
3. Check the file names and any executable flags
4. Download individually, or copy the listing

FAQ

How is an embedded attachment different from an image on the page?

An embedded file is a whole separate file stored inside the PDF, which readers usually expose in an “Attachments” sidebar you can open or save from. Images on a page, hyperlinks in the text and files in annotations do not work that way — they are part of the page content. So “does this PDF carry anything extra” is a question about the former, which is what this tool answers; to pull images out of pages, use the image extractor.

If it says “executable”, is it definitely malicious?

No. The check is on the extension alone, so: ① a perfectly ordinary automation script (`.sh`, `.ps1`) gets flagged too; ② not being flagged does not mean safe — malware can be a `.doc` with macros, something disguised as another type, or simply a normal-looking PDF. The flag exists to draw your attention, not to deliver a verdict. The real judgement is yours to make from the source: who sent this PDF, and what did you expect to be in it?

Why can it not add attachments?

Because there is no way to say which file is the subject. Adding an attachment needs an input of “one PDF plus some attachment files”, while this family of tools is built on “drop files in, get files out” — it cannot express “the first one is the document, the rest are attachments”. The only way to force it would be to assume “the first `.pdf` is the subject”, and that assumption fails silently when you drop them in the wrong order: the PDF you meant to attach is treated as the document and you get something nonsensical. So that direction is not offered.

Are attachments uploaded, or executed?

Neither. Parsing uses pdf.js bundled into this page and happens entirely in memory on your machine, with no network requests. An attachment is only decoded into bytes and wrapped in a download blob — never executed, never parsed, never rendered, and there is no “open it” button anywhere.