Free Document Sanitizer
This is a free document sanitizer that removes malicious content from files before you share or open them. Upload a PDF, Word, Excel, PowerPoint, or image file and we rebuild it from flattened pixels, stripping macros, embedded scripts, and malicious links, then give you back a clean PDF. No account required.
PDF, DOCX, XLSX, PPTX, PNG, JPG. Max 4MB.
How it works: rasterize and rebuild
This tool uses content disarm and reconstruction (CDR), the same approach used by Dangerzone. Instead of scanning your file for known-bad patterns, it rasterizes every page to flat pixels, then rebuilds a brand-new PDF from those pixel images only. Nothing from the original file's underlying structure, code, or markup carries over. A macro, an embedded script, or a malicious hyperlink has no way to survive that round trip: there is no macro, script, or hyperlink left in a page that is just a picture.
This is a different guarantee than antivirus scanning. Signature and heuristic scanners only catch threats they already recognize. Rasterize-and-rebuild removes the entire category of file-embedded active content regardless of whether it matches a known signature, including novel or zero-day payloads.
What it removes
- VBA macros in Word, Excel, and PowerPoint files
- Embedded JavaScript in PDFs
- OLE objects and embedded executables
- Remote template injection and other "phone home" triggers in Office files
- Clickable malicious links and redirect chains
The upload is validated by its magic-byte signature, not its file extension or the browser-reported content type, both of which an attacker controls and can fake.
Supported file types and limits
| Input | Output | Limit |
|---|---|---|
| PDF, DOCX, XLSX, PPTX, PNG, JPG | PDF (always) | 4MB per file, 5 files/hour per IP |
Output is always a PDF, even when you upload an Office document or an image. That is a direct consequence of the rasterize-and-rebuild method: once a page becomes flat pixels, PDF is the natural container to rebuild it into.
Document Sanitizer vs. Dangerzone
Dangerzone is a free, open-source desktop app you install and run locally, converting files inside an isolated container on your own machine with no network access during conversion. That gives it a stronger isolation guarantee than any web-based tool can offer.
This tool trades some of that isolation for convenience: no install, works from a phone or a locked-down work laptop, done in seconds. The conversion step runs on a separate, isolated service with zero API keys or credentials to any of our other systems, so even a worst-case failure in the conversion step has nothing to reach or steal. It is not a full network-egress lockdown the way a fully offline tool is. For a routine attachment from an unknown sender, that tradeoff is reasonable. For a file you already suspect is a targeted, high-value attack, run it through Dangerzone offline instead.
Recommended: Bitdefender GravityZone
Sanitizing catches one file when you remember to upload it. GravityZone scans every file automatically in real time, with EDR and ransomware remediation built into one lightweight agent, so lean IT teams get always-on coverage without running a full SOC.
Frequently asked questions
Is this a replacement for antivirus scanning?
No. Treat it as an extra layer for files you are unsure about, on top of your existing endpoint protection, not a replacement for it.
Does the sanitized file look the same as the original?
Visually, yes: every page is rendered exactly as it appeared and rebuilt as a PDF. What does not survive is anything that was not visible content: macros, scripts, embedded objects, and active links.
Why can I only sanitize 5 files an hour?
Conversion is CPU and memory-heavy (it runs a full document rendering pipeline per file), so the rate limit keeps the tool free and available to everyone instead of one user or a bot exhausting it.
Do you keep a copy of my file?
No. The file is processed in temporary storage and deleted immediately after conversion, on both sides of the pipeline. We only log metadata (IP, file size, format, outcome, and a hash) for abuse prevention.