Can a PDF have a virus?

Yes, a PDF can carry a virus or other malicious content. A PDF can contain JavaScript, embedded files, links to phishing pages, and code built to exploit bugs in PDF readers. Opening a PDF in an up-to-date browser viewer like Chrome, Edge or Firefox is low risk, because those viewers are sandboxed and don't run most PDF scripts. Old or unpatched desktop readers carry more risk.

Can a PDF file contain a virus?

A PDF looks like a static page, but the format can hold much more than text and pictures. That extra capacity is what attackers use. The main ways a PDF can be harmful are:

• Embedded JavaScript. The PDF format supports scripts for things like form calculations. A malicious file can use them to try to run actions when it opens.
• Embedded or attached files. A PDF can carry other files inside it, including programs or documents with macros. The PDF itself is just the wrapper.
• Links to phishing sites. The most common trick is also the simplest: a PDF that looks like an invoice or a shared document, with a button that leads to a fake login page.
• Reader exploits. Some files are crafted to trigger a bug in a particular PDF reader, so that opening the file runs code on your computer. These only work against readers that haven't been patched.

So the risk depends a lot on two things: what software opens the file, and what you click once it's open.

Can you get a virus from opening a PDF?

It's possible, but much less likely than it used to be if your software is current. Modern browsers open PDFs in their own built-in viewers. Those viewers run inside the browser's sandbox, which limits what a file can reach on your computer, and they ignore most of the JavaScript actions a malicious PDF might contain.

Desktop readers vary more. A fully updated reader is reasonably safe. One that hasn't been updated in years may have known holes that attackers can still use. The same goes for an old phone or tablet that no longer gets updates.

In practice, most PDF attacks don't need a technical exploit at all. They rely on you clicking a link, entering a password or opening a file that the PDF points to. Opening the document is rarely the step that does the damage. What you do next usually is.

How to tell if a PDF is malicious

There's no single sign, but some patterns are common enough to treat as warnings:

• You weren't expecting it, or it came from someone you don't know.
• The email is urgent: an unpaid invoice, a locked account, a parcel you can't remember ordering.
• The PDF is almost empty apart from a big button telling you to click to view the real document.
• Your reader shows a prompt asking you to allow scripts, enable editing or open an attached file.
• A link leads to a login page asking for your email or bank password.
• The file name ends in something like ".pdf.exe", or the "PDF" turns out to be inside a ZIP with other files.

If a known sender's message seems odd, check with them another way before opening anything. Accounts get hacked, and a real contact's address doesn't guarantee a safe attachment.

How to open a PDF safely

A few habits cover most of the risk:

1. Keep your browser, PDF reader and operating system updated. Patches close the holes that reader exploits depend on.
2. Open unexpected PDFs in your browser's viewer rather than a desktop reader, especially if you don't know the sender.
3. Don't approve prompts to enable scripts, editing or macros, and don't open files embedded inside a PDF.
4. Never type a password into a page a PDF sends you to. Go to the site directly by typing its address.
5. Scan the file with your antivirus before opening it. On Windows, Windows Security (Microsoft Defender) is built in: right-click the file and choose the scan option.
6. When in doubt, delete it and ask the sender to confirm.

Is it safe to use online PDF tools?

That's a separate question from viruses, and it's about privacy. Many online PDF tools upload your file to a server, process it there and send it back. That's usually fine for a menu or a brochure. It's less comfortable for a bank statement, a contract or an ID scan.

ConvertorLab's PDF tools process files inside your browser, so the file never leaves your device. That makes it a reasonable choice for sensitive documents. If you want to share a document without passing along anything hidden inside it, converting the pages to images with PDF to JPG keeps only what's visible on each page. For files you send to others, Lock PDF adds a password with AES-256 encryption.

Browser-based processing doesn't make a dangerous file safe. It just means you aren't handing your documents to a third party. The browser file privacy guide explains how local processing works.

What to do if you opened a suspicious PDF

Don't panic. Opening a PDF in a current browser rarely causes harm on its own. Work through these steps:

1. Close the file, and don't click anything else in it.
2. If you entered a password on a page it linked to, change that password right away, starting with your email account. Turn on two-step verification if it isn't already on.
3. Run a full scan with your antivirus.
4. Check that your browser and PDF reader are up to date, and install any pending system updates.
5. If it was a work device, tell your IT team. They may have seen the same email elsewhere.

For more everyday habits around handling documents, see the safe file workflow guide.

Frequently asked questions