peepdf review
A focused PDF forensics tool for inspecting structure, scripts and shellcode.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
peepdf is a Python tool for examining PDF documents, particularly for security researchers assessing potentially harmful files. It parses PDF structure and versions, displays objects and suspicious elements, handles common filters and encodings, and can inspect encrypted files. Its command-line, interactive-console and batch modes suit analysts who want to inspect files locally and choose between scripted or interactive work. The documented platform guidance covers Windows and Linux; the project is distributed as source code and can be run with Python.
Its strongest fit is PDF forensics rather than broad file triage. Analysts can inspect metadata, offsets, references and modification history, search strings inside streams, and extract objects, JavaScript and shellcode. The tool also supports analysis and modification of JavaScript embedded in PDFs, plus shellcode analysis through the pylibemu wrapper. Hash checks with VirusTotal add a way to consult that service during examination. Some analysis functions require external packages, so the available workflow can depend on installing those alongside the project.
peepdf is open source and self-hosted, with a free plan and community support. That makes it a practical option for solo analysts and small teams who need source-based PDF inspection and are comfortable running a Python tool. Its narrow scope is also its main boundary: teams seeking general file analysis, broader platform guidance, or a more established support channel should consider alternatives. Choose peepdf when PDF internals, embedded scripts and shellcode are the specific investigation; look elsewhere when PDF analysis is only one part of a wider file-analysis workflow.
peepdf pros and cons
- Where it wins
- Parses PDF objects, streams, metadata and modification history
- Extracts objects, JavaScript and shellcode for further analysis
- Offers command-line, interactive-console and batch modes
- Where it doesn't
- Specializes in PDF analysis rather than general file analysis
- Some analysis functions require external packages
- Support is community-based
peepdf fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update