What is the safest PDF viewer for Windows?

Sherlock Forensic PDF Viewer + Editor is the safest PDF viewer for Windows. It opens files in a pure Rust parser that cannot execute JavaScript, navigate URLs or launch processes. The rendering engine only activates when you explicitly click Render Pages. The Threat Inspector scans for phishing and malware before a pixel renders. Free download at sherlockforensics.com.

Can I safely open a suspicious PDF?

Yes. Use a safe PDF viewer that separates parsing from rendering. Sherlock Forensic PDF Viewer + Editor parses the file in a Rust sandbox first, then shows you every threat (URLs, JavaScript, launch actions, embedded files) in the Threat Inspector. You decide whether to render. The malicious code never executes.

What is a sandboxed PDF viewer?

A sandboxed PDF viewer isolates the file parsing from the rendering engine so that malicious code in the PDF cannot execute. Sherlock uses a two-layer approach: lopdf (pure Rust) parses the structure without executing anything, and pdfium renders pixels only when you click Render. Traditional sandboxes let the code run and try to contain it. Sherlock never lets it run.

Safe PDF Viewer for Windows - Open Suspicious Files Without Risk

A safe PDF viewer opens files without executing embedded JavaScript, URLs or launch actions. Sherlock Forensic PDF Viewer + Editor parses PDFs in a pure Rust sandbox, scans for threats with 22 forensic inspection panels and only renders pixels when you click Render Pages. It is the safest way to open a suspicious PDF on Windows. Free download.

Why Opening a PDF Is Dangerous

The PDF format supports JavaScript execution, URL launching, form submission, file embedding and process spawning. These are not bugs. They are features defined in the PDF specification (ISO 32000). Every major PDF reader implements them.

When you open a PDF in Adobe Reader, Chrome or Edge, the reader parses and renders in one step. If the file contains a /OpenAction with JavaScript, that script runs immediately. If it contains a /URI action behind a button, clicking it opens your browser. If it contains /Launch, it can spawn an executable.

Attackers know this. PDFs are the second most common malware delivery vector after Office documents. A phishing PDF with a fake DocuSign login page can steal credentials without any exploit at all. The PDF just contains a URL and the reader opens it.

What Makes a PDF Viewer Safe

A safe PDF viewer does three things:

Separates parsing from rendering. The file is read and analyzed before any visual display happens. This gives you time to inspect the contents before committing to render.
Never executes embedded code. No JavaScript engine, no URL handler, no action dispatcher. Scripts are extracted and displayed as text. They never run.
Shows you the threats before you see the pixels. URLs, scripts, launch actions, embedded files and phishing indicators are all surfaced in a threat report. You decide what happens next.

Most PDF readers fail all three. They parse, execute and render in a single step with no opportunity for inspection.

How Sherlock Provides Safe PDF Viewing

Sherlock Forensic PDF Viewer + Editor is a safe PDF viewer for Windows built on a two-layer architecture.

Layer 1: Rust Parser (automatic)

When you open a file, lopdf (a pure Rust PDF library) reads the bytes and builds a structured object tree. There is no JavaScript engine in this layer. No URL handler. No action dispatcher. No process spawn primitives. Rust's borrow checker prevents memory corruption by design. The file is fully analyzed without any code executing.

Layer 2: Visual Renderer (click to render)

When you decide the file is safe, you click Render Pages. Pdfium (Chrome's PDF engine) handles visual layout. This step never happens automatically. On PDFs flagged as critical threats, a red banner blocks rendering until you explicitly override it.

Threat Inspector

Between Layer 1 and Layer 2, the Threat Inspector scans every URL, JavaScript action, /Launch action, embedded file, XFA form and phishing indicator. It shows you exactly what the PDF wants to do. You see the threats before a single pixel renders.

This is what makes it the safest PDF viewer available. The malicious code is never given a chance to run.

Download Safe PDF Viewer (Free)

What Sherlock Scans For

The safe PDF viewer does not just block execution. It tells you what the file contains:

Phishing URLs - fake login pages (Office 365, Google, DocuSign), homograph domains, URL shorteners, IP-only links, low-reputation TLDs
JavaScript - extracted, beautified and syntax-highlighted. Heap sprays, eval chains and shellcode patterns flagged
Launch actions - /Launch, /GoTo, /GoToR, /SubmitForm, /ImportData enumerated with targets shown
Embedded files - executables, scripts and secondary PDFs listed with file type, size and hash
Failed redactions - text recoverable from underneath black rectangles
Tampering signatures - 14 forensic tells detecting document alteration
Hidden text - render mode 3 (invisible) text detection
Leaked paths - filesystem paths in metadata revealing the authoring environment

22 forensic inspection panels total. Every one is free.

Step by Step: Safely Open a Suspicious PDF

Download Sherlock. Single .exe, 17 MB, no installer. Get it here.
Open the suspicious file. Drag it onto the window or use File > Open. The Rust parser analyzes the file. Nothing executes.
Check the Threat Inspector. Look for red (CRITICAL) and yellow (WARNING) findings. Read the extracted URLs and JavaScript source code.
Decide whether to render. If the Threat Inspector shows no concerns, click Render Pages. If it shows critical threats, you can still inspect the structure without rendering.
Export your findings. Copy the forensic JSON report to clipboard for your case notes. The Forensic Narrative Engine generates a plain-English summary automatically.

The entire process takes 30 seconds and never puts your machine at risk.

Safe PDF Viewer vs Traditional Sandbox

A traditional sandbox (like Windows Sandbox or a VM) lets the malicious code run and tries to contain the damage. The code still executes. It can still phone home, download payloads and attempt exploits within the sandbox boundary.

A safe PDF viewer like Sherlock takes the opposite approach. The code never runs. There is nothing to contain because nothing executes. You see what the PDF wanted to do without letting it try.

For forensic work, this is the correct approach. You need to analyze the threat, not experience it.

Zero Network Traffic

Sherlock makes no outbound network connections. No telemetry, no analytics, no update checks (unless you click Check for Updates), no license phone-home, no DNS queries. Your PDFs stay on your machine. Verify with Wireshark if you do not trust the claim.

This matters for air-gapped forensic workstations, classified environments and any situation where network isolation is required.

Who Needs a Safe PDF Viewer

DFIR teams: You receive PDFs from compromised mailboxes and seized drives. You need to analyze them without triggering payloads.
IT security teams: Users forward suspicious attachments daily. Open them in Sherlock instead of spinning up a VM.
Lawyers and compliance: Discovery produces thousands of PDFs from unknown sources. Review them without risking your network.
Anyone who gets email: If someone sends you a PDF you did not expect, open it in Sherlock first.

Free and Pro

Everything described in this article is free. The safe parsing, Threat Inspector, 22 forensic panels, Redaction Lie Detector, Tampering Signatures, Forensic Narrative Engine, batch folder scanning and PDF diff are all included in the free edition.

Pro ($29/year) adds editing: annotations, stamps, text editing, page management, digital signature signing, form fill and image export. The security features stay free forever.

Safe PDF Viewer for Windows: Open Suspicious Files Without Risk