Sometimes deleting is not an option. The PDF might be a real contract from a new client, a court filing, or a document you were told to read. The goal in that situation is simple: view the pages while giving the file no ability to execute anything. Here is how to do that on each platform, from least to most effort.
First: scan it, don't just open it
Before choosing a viewer, find out what you are dealing with. Drop the file into the PDF Virus Scanner. It runs entirely in your browser tab, nothing is uploaded, and it reports whether the file contains JavaScript, automatic open actions, launch commands, embedded files or remote-submit actions. A file with none of those is far less likely to hurt you in any viewer. A file with several of them deserves the strictest option below.
Option 1: Your browser's built-in viewer
Chrome, Edge and Firefox all ship their own PDF renderers, and they run inside the browser's sandbox. Chrome's viewer (PDFium) and Firefox's viewer (PDF.js) ignore `/Launch` actions and either ignore or heavily restrict PDF JavaScript. A memory-corruption exploit would still have to escape the browser sandbox, which is much harder than escaping a desktop reader.
To use it, drag the PDF onto a browser window or press Ctrl+O / Cmd+O in the browser. Do not click any links inside the document. This is the best default for most people: no setup, strong isolation, and it is where the file already opens if you clicked it in webmail.
Option 2: Adobe Acrobat Reader with JavaScript off and Protected View on
If you need Acrobat features (comments, form filling, signatures), lock it down first. These settings are in Acrobat Reader → Edit → Preferences (Windows) or Acrobat Reader → Settings (macOS):
- JavaScript → uncheck "Enable Acrobat JavaScript". Most attacks on Acrobat start with a script.
- Security (Enhanced) → set Protected View to "All files". The document renders in a sandbox and cannot write to disk or start programs until you explicitly enable it.
- Trust Manager → uncheck "Allow opening of non-PDF file attachments with external applications". This neuters `/Launch` and embedded-file tricks.
- Trust Manager → Internet Access → set to "Block PDF files' access to all web sites" so `/URI` and `/SubmitForm` actions cannot phone home.
Also make sure Reader is up to date (Help → Check for Updates). Every major PDF zero-day of the last decade targeted an unpatched reader.
Option 3: macOS Preview
Preview does not execute PDF JavaScript at all and does not honor launch actions, which makes it a reasonable choice for suspicious files. It still parses fonts and images, so a crafted file could in theory target a bug in Apple's PDFKit. Keep macOS updated and combine Preview with Quick Look (select the file in Finder and press Space) for a first glance that involves even less code.
Option 4: A disposable virtual machine
For files flagged with multiple risky structures, or anything from a source you actively distrust, open it in an environment you can throw away. On Windows 10/11 Pro, Windows Sandbox (enable it under Windows Features) gives you a clean, disposable desktop in seconds: copy the PDF in, open it, close the sandbox and everything is gone. On any OS, a VirtualBox or UTM virtual machine with a snapshot works the same way. Disable shared folders and clipboard sharing before opening the file.
What not to do
Do not open a suspicious PDF in an old desktop reader, do not click "Enable" or "Allow" on any prompt the document triggers, and do not open attachments you find inside it. If the file asks you to do any of those things to "view the content", the content is the attack.
Convert it to something inert
If you only need the text or the images, you can strip the PDF's active content by converting it. Rendering the pages to images with PDF to JPG or PDF to PNG produces plain pictures that carry no scripts, actions or attachments, and the conversion runs locally in your browser. It is a blunt tool, but it turns a programmable container into a stack of photos.
Summary
- Scan the structure locally to see what the file can do.
- Default to the browser viewer: sandboxed, JavaScript restricted, no setup.
- If you must use Acrobat, disable JavaScript, enable Protected View for all files, block attachments and web access.
- For genuinely hostile files, use Windows Sandbox or a throwaway VM.
- Never click through security prompts inside the document.
Background reading: can a PDF have a virus? and the full how to check if a PDF is safe checklist.