What Is Dangerzone and What Does It Do?

Updated

Dangerzone is a free, open source tool that converts potentially dangerous documents into safe PDFs. You give it a file you don't fully trust — a PDF, an office document, or an image — and it returns a PDF that has been rebuilt from pixels, so any embedded malware is destroyed in the process. It is maintained by the Freedom of the Press Foundation (FPF), a nonprofit that protects and defends press freedom, and the current release listed on the site is Dangerzone 0.11.0.

The problem it solves

Opening an untrusted attachment is a routine risk: a malicious PDF or office file can exploit a viewer, run code, or quietly reach out to a network. Dangerzone's approach is to never let the original file reach your normal viewing environment intact. Instead, the document is rendered inside a secure sandbox and reconstructed as a fresh PDF, so what you eventually open is not the file you received.

How it works

The process described on the site has three stages:

  1. You provide an untrusted document — for example, an email attachment.
  2. Inside a sandbox, the document is converted to a PDF if it isn't already one, and then the PDF is converted into raw pixel data: a large list of RGB color values for each page.
  3. That pixel data is converted back into a PDF, which is the file you can safely view locally.

Because the output is rebuilt from pixels rather than copied, any hidden scripts, embedded objects, or exploits in the original are left behind.

What it supports and how it isolates files

Feature What the site states
File types More than 20, including PDFs, all major office-suite formats, and the most common image types
Malware removal Destroys malware by rendering the document to pixels in a secure sandbox and reconstructing it locally as a PDF
Network access Documents are sanitized in a sandbox with no network access, so a compromised document can't communicate out
Maintenance Free and open source project maintained by the Freedom of the Press Foundation

The no-network sandbox matters because it closes the exfiltration path: even if a document could compromise the sandbox, it has no way to send anything back out.

Who it's for

Dangerzone fits anyone who regularly handles files from unknown or untrusted sources — journalists receiving leaked documents, analysts opening emailed attachments, or anyone who wants a safer way to read a PDF before trusting it. It is not a general antivirus or a replacement for keeping your PDF reader patched; it is a conversion step you run before viewing a file you don't trust.

Getting it

Downloads are listed for macOS (with separate Intel and Apple Silicon builds, plus a guide to checking which chip you have), Windows, Ubuntu/Debian, Fedora, Tails, and other Linux distributions, with a build-from-source option and a beta install for Qubes OS. The site also provides instructions for verifying your download.