PDF JavaScript runs within a PDF-specific object model (the Acrobat JavaScript API) that exposes PDF document objects alongside the standard ECMAScript environment. Common legitimate uses:

<strong>Form calculations</strong> — Automatically calculate a sum, tax amount, or subtotal when other fields are filled. The <code>event.value</code> object and field-level calculation scripts run every time a dependent field changes.

<strong>Form validation</strong> — Check that an entered email address matches a pattern, that a date is not in the past, or that required fields are not empty before submission. Validation scripts run when the field loses focus or when the form is submitted.

<strong>Conditional field visibility</strong> — Show or hide form fields based on a selection elsewhere in the form (e.g., show additional fields if a checkbox is ticked). Uses the <code>field.display</code> property.

<strong>Auto-populate fields</strong> — Fill the current date, or pre-populate fields from other field values.

<strong>Document-level events</strong> — Execute code when the document is opened (<code>app.alert</code>), when a page is turned, or when the document is printed.

<strong>Form submission</strong> — Submit form data to a web server via HTTP using <code>this.submitForm()</code>.

These capabilities are used extensively in government forms, insurance applications, tax documents, and enterprise HR forms — particularly those distributed by organisations using <a href="https://pdftheguide.com/glossary/acroform" target="_blank" rel="noopener">AcroForms</a> or the deprecated <a href="https://pdftheguide.com/glossary/xfa-form" target="_blank" rel="noopener">XFA</a> format.

PDF JavaScript support varies dramatically across PDF viewers:

<strong>Adobe Acrobat / Adobe Reader</strong> — Full PDF JavaScript support. Runs the Acrobat JavaScript engine with access to the complete Acrobat JavaScript API. JavaScript is enabled by default but can be disabled under Edit > Preferences > JavaScript.

<strong>Browser-based viewers (Chrome, Edge, Firefox built-in PDF.js)</strong> — PDF JavaScript is completely disabled. <a href="https://mozilla.github.io/pdf.js/" target="_blank" rel="noopener">PDF.js</a> (the open-source viewer used in Firefox and Chrome) deliberately does not execute PDF JavaScript as a security measure. This means any PDF that relies on JavaScript for form calculations, validation, or conditional behaviour will not work in browser viewers.

<strong>Foxit Reader / Foxit PDF Editor</strong> — Supports PDF JavaScript with its own JavaScript engine, broadly compatible with the Acrobat API.

<strong>macOS Preview, Apple Books</strong> — Does not execute PDF JavaScript.

<strong>Mobile PDF viewers</strong> — Generally do not execute PDF JavaScript.

The security implications: a malicious PDF JavaScript can in theory make HTTP requests (leaking the user's IP address and opening time to a remote server), attempt to access the file system through vulnerabilities in the viewer, or exploit JavaScript engine bugs. Adobe Reader runs PDF JavaScript in a sandboxed process on modern systems. The <a href="https://www.cisa.gov/" target="_blank" rel="noopener">CISA</a> and most enterprise security policies recommend disabling PDF JavaScript in environments where it is not operationally required.

Both AcroForm and XFA form types use JavaScript, but with different scopes and APIs:

<strong>AcroForm JavaScript</strong> — Standard PDF JavaScript as described in the Acrobat JavaScript API reference. Scripts are attached to form fields (field-level events: validate, calculate, format, keystroke, focus/blur) or to the document (document-level events: open, print, save, close).

<strong>XFA JavaScript</strong> — XFA forms use a separate event model based on XFA FormCalc (a non-ECMAScript calculation language) or ECMAScript with the XFA object model. XFA JavaScript is entirely different from AcroForm JavaScript and is only supported by Adobe Acrobat/Reader.

The practical difference: an AcroForm with JavaScript calculations will work in Foxit Reader but not in browsers. An XFA form with FormCalc or XFA JavaScript will only work in Adobe Acrobat/Reader — no other viewer supports it.

For new form development, the PDF community strongly recommends AcroForms over XFA (Adobe deprecated XFA in 2021) and minimising JavaScript dependency to maximise viewer compatibility. For complex dynamic behaviour, modern practice favours web-based HTML forms with PDF output generation, rather than PDF-embedded JavaScript.

To remove JavaScript from a PDF:

<strong>Adobe Acrobat Pro</strong> — Tools > Redact > Sanitize Document removes JavaScript (along with metadata, attachments, and hidden layers). Alternatively, Tools > Action Wizard > Remove Hidden Information targets JavaScript specifically.

<strong>Ghostscript</strong> — <code>gs -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -dNoOutputFonts -sOutputFile=output.pdf input.pdf</code> — Ghostscript's pdfwrite device processes and re-outputs the PDF; JavaScript is not preserved in the output.

<strong>Inspection</strong> — To check whether a PDF contains JavaScript without removing it, use <a href="https://exiftool.org/" target="_blank" rel="noopener">ExifTool</a> (<code>exiftool -JavaScript filename.pdf</code>) or Adobe Acrobat's Document Properties > JavaScript panel.

Note: removing JavaScript from a form that depends on JavaScript for calculations or validation will break that functionality. Only remove JavaScript from forms after verifying the JavaScript is not required for the form to function, or when the security risk outweighs the form functionality.