Portable Document Format (ISO 32000)
Object-graph document format parsed bottom-up from its trailing `startxref` and `%%EOF` markers—primary battleground for AI RAG table extraction and active `/JavaScript` upload sanitization.
Many PDF readers scan for `%PDF-` anywhere within the first 1024 bytes! Combined with bottom-up `xref` parsing, PDF is a frequent polyglot target unless offset `0x00` is strictly enforced.
Drop any .pdf file (even 100 GB+) to inspect locally
Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded
.pdf Magic Bytes & Header Offset Map
5-byte '%PDF-' header followed by version (e.g. 1.7 or 2.0)
| Byte Offset | Length | Data Type | Field Name | Engineering Description |
|---|---|---|---|---|
| 0x00 - 0x07 | 8 B | ascii | pdf_version | '%PDF-1.7' version header |
| 0x09 - 0x0E | 6 B | uint8[6] | binary_comment | High-bit comment (%\xE2\xE3\xCF\xD3) signaling binary content |
| EOF-64.. | var | ascii | xref_trailer | Cross-reference table, startxref byte offset & %%EOF |
.pdf Security & Polyglot Risk Matrix
Require '%PDF-' strictly at offset 0x00 (blocking polyglots), verify trailing '%%EOF', and reject or flatten `/JavaScript`, `/JS`, `/Launch`, and `/EmbeddedFiles` actions.
Read .pdf Header & Metadata Without Heavy Dependencies
import os, sys
with open(sys.argv[1], "rb") as f:
head = f.read(8)
f.seek(-64, os.SEEK_END)
tail = f.read(64)
assert head.startswith(b"%PDF-") and b"%%EOF" in tail
print(f"Valid {head.decode('ascii', 'ignore').strip()}")Deterministic .pdf Sample Files & Edge Cases
minimal-1page.pdf
Real single-page PDF generated by reportlab and parseable by pypdf.
curl -fsSL https://fileformat.co/fixtures/v1/pdf/minimal-1page.pdf -o minimal-1page.pdf \
&& echo "3d510c3e24ce7b489b9861769c0643c75e13c5364754a752186baaf68546a0d7 minimal-1page.pdf" | shasum -a 256 -crag-two-column-financial-table.pdf
Real 2-page reportlab PDF with financial Table cells, heading hierarchy and rule lines for RAG extractor benchmarking.
curl -fsSL https://fileformat.co/fixtures/v1/pdf/rag-two-column-financial-table.pdf -o rag-two-column-financial-table.pdf \
&& echo "d547e41d47d805961980567b9776216f65f3744ea2906789dfa6bb629c40569a rag-two-column-financial-table.pdf" | shasum -a 256 -cbenign-js-dictionary-canary.pdf
Real reportlab PDF with an inert /JavaScript name tree added via pypdf (FILEFORMAT_CO_BENIGN_TEST_MARKER) for security scanner verification.
curl -fsSL https://fileformat.co/fixtures/v1/pdf/benign-js-dictionary-canary.pdf -o benign-js-dictionary-canary.pdf \
&& echo "dc38f4be9c4ba992b60254dab44878c1c111e7d7bd06169e6a3836a48850cfc3 benign-js-dictionary-canary.pdf" | shasum -a 256 -cRelated Specifications & Alternatives
ZIP-packaged XML spreadsheet container (`[Content_Types].xml` + `xl/workbook.xml`). Frequently misdiagnosed when backend export endpoints fail and save HTML/JSON error pages as `.xlsx`.
Plain-text tabular interchange format notorious for real-world parser edge cases: optional UTF-8 BOMs (`EF BB BF`), multiline quoted cells, doubled quote escapes (`""`), and formula injection.
Lossless CRC-checked chunked raster image format, heavily used in AI workflows (ComfyUI / Stable Diffusion) to store generation graphs and prompts inside `tEXt`/`iTXt` chunks.