---
id: pdfid
version: "1.1.3"
license: unclear
license_treatment: permissive
maintenance: abandoned
---

# pdfid — PDFID simple tool to analyze PDF malicious files by DidierStevens. Customized by Matteo Lodi to be used as a library.

License: permissive · Maintenance: abandoned · Downloads: 295.6K/mo

## What it is and what it does

pdfid is a port of Didier Stevens' PDF analysis tool, designed to detect potentially malicious PDF files by examining their structure and embedded objects. It works as both a standalone command-line utility and as an importable Python library, allowing you to programmatically scan PDFs for suspicious characteristics without requiring external dependencies.

The tool identifies PDF features commonly associated with exploits—such as embedded JavaScript, suspicious object types, or unusual compression—to help security researchers and developers flag files that warrant deeper inspection. Because it has no runtime dependencies and supports a wide Python version range, it integrates easily into existing workflows, though its analysis approach is structural rather than behavioral.

Use it for:

- Scan uploaded PDFs in a web application to flag potentially malicious files before processing or storage.
- Batch-analyze PDF repositories to identify suspicious documents for manual review by security teams.
- Integrate PDF threat detection into automated malware scanning pipelines or security monitoring systems.
- Examine PDF structure during reverse-engineering or incident response investigations.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Analyzes PDF files to identify potentially malicious content by examining structural characteristics and embedded objects, usable both as a command-line tool and as a Python library.

Yes, if you need lightweight PDF structural analysis and can accept that the tool is no longer maintained. The low install friction and permissive license make it practical for security workflows, but verify that its heuristics meet your threat model and test compatibility with your Python environment before relying on it in production.

## Install

pip install pdfid
uv add pdfid
poetry add pdfid

## Installing pdfid

Before you install: Low install friction with no runtime dependencies. However, the package is abandoned—last updated 2023-06-06, over 1165 days ago—so expect no maintenance, bug fixes, or compatibility updates for modern Python versions.

License in practice: MIT license permits free use, modification, and distribution with minimal restrictions, making it suitable for both open-source and commercial projects.

Quickstart:

pip install pdfid

import pdfid
# See test.py in the repository for library usage examples

Requires Python 2.6 or later (up to Python 3.x); verify compatibility with your specific Python version before use in production.

Verify before relying:

- Whether the tool's PDF analysis heuristics remain effective against current malware techniques and PDF specifications.
- Compatibility with Python versions beyond what was tested at the time of the last release.

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: abandoned
- Downloads: 295.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

pdf malware analysis, pdf structure inspection, pdf security scanning, analyze pdf files, pdf object detection, pdf threat assessment, pdf-analysis, malware-detection, security-tools

[View on SkillFed](https://skillfed.io/packages/pdfid) · [View on PyPI](https://pypi.org/project/pdfid/)