PDF Attachments and Embedded Files

A PDF can carry other files inside it. The feature, called "file attachments" or "embedded files," has been in the PDF spec for two decades and powers everything from email-style attachments to regulatory submissions. It is also a frequent surprise: many users don't know their PDFs have hidden files inside. This guide covers what embedded files are, how they work, and the real-world cases where they matter.

What embedded files are

A PDF can contain arbitrary file attachments:

Other PDFs.
Word, Excel, PowerPoint files.
Images, audio, video.
ZIP archives.
Source code, datasets.
Anything else.

These attachments live inside the PDF as embedded streams. The PDF reader exposes them via an "Attachments" panel.

Where you see them

Common contexts:

Email-style "PDF with attachments": a cover letter PDF with the actual deliverables inside.
Regulatory submissions: an FDA package, a court filing, a tax filing with supporting docs.
Architectural drawings: a sheet set with embedded specifications, datasheets, or calculations.
Hybrid PDFs: see hybrid PDF explained (a specific kind that embeds the source document).
Forensic and discovery: documents with embedded evidence.

How embedded files work

In PDF internals (see PDF internals: objects and streams):

Each embedded file is a stream object with the file's bytes.
A "filespec" dictionary describes the file: name, modification date, size, MIME type.
The catalog's /Names tree or the page's /Annots array reference the embedded files.

Two main flavors:

Document-level attachments: shown in the Attachments panel; accessible from anywhere in the PDF.
Page-level annotations (FileAttachment annotations): shown as paperclip icons on a specific page.

Accessing attachments

In viewers:

Adobe Acrobat / Reader: View > Attachments, or the paperclip icon in the sidebar.
Foxit Reader: similar.
Preview (Mac): limited; sometimes hidden.
Browser PDF viewers: variable; many don't expose attachments well.
Mobile: limited.

For maximum accessibility, mention attachments in the document text so users know to look for them.

Adding attachments

Tools that embed files:

Adobe Acrobat Pro: Tools > Edit PDF > More > Attach File.
Foxit PhantomPDF: similar workflow.
Programmatic: pdf-lib, iText, PDFBox can embed.
Some browser PDF tools support attachments.

A typical use: a cover-letter PDF generated by your CRM, with the attached purchase order, NDA, and pricing PDF embedded.

File size implications

Attachments add to the PDF size. A 1 MB cover letter with three 5 MB attachments becomes a 16 MB PDF. Plan accordingly:

For email, attachments may push over size limits.
For web, large PDFs deter downloads.
For archival, this is often fine.

Compression

Embedded files are typically streams with /Filter /FlateDecode (zlib) compression. Some content (already-compressed files like ZIP, JPEG, MP4) doesn't compress further; embedding is still useful for packaging.

For deeper compression details, see PDF compression filters explained.

Use case: regulatory submissions

Many regulators accept submissions as a single PDF with attached components:

FDA NDA/BLA submissions: hyperlinked TOC with embedded study reports.
Court filings: motion plus exhibits, often as a single combined PDF (sometimes with attachments rather than appended pages).
Tax filings: returns with embedded supporting documents.
Patent applications: text plus drawings plus tables.

The single-file-with-attachments model simplifies submission, transmission, and archival.

Use case: archival

Archival packages benefit from self-contained PDFs:

Source documents embedded in the rendered PDF.
Photographs and supporting media included.
Spreadsheet sources alongside their rendered reports.

For long-term archival, this is the OAIS-style "submission information package." See OAIS model for document preservation.

Use case: hybrid PDFs

A specific pattern: hybrid PDFs embed their own source document. LibreOffice can save a PDF that contains the original ODT file, so the PDF is both a rendered view and a re-editable source.

See hybrid PDF explained.

Security considerations

Embedded files have been a malware vector:

Malicious binaries embedded in PDFs, launched via JavaScript on open.
Phishing attachments: a PDF with an embedded "invoice.docx" that's actually malware.
Hidden exfiltration: leak data via embedded files in shared PDFs.

Modern viewers sandbox embedded file execution:

Don't auto-open embedded files.
Warn before extracting.
Strip dangerous file types in some viewers (executables, scripts).

For senders of legitimate PDFs:

Embed only what's necessary.
Don't embed executables.
Sign the PDF so users trust attachments.

For users:

Treat embedded files with the same suspicion as email attachments.
Don't open unexpected attachments.
Scan with antivirus before opening.

For broader security context, see are online PDF editors safe and PDF and zero-trust document security.

Hidden data risk

Embedded files are part of the "hidden data" concern:

A PDF for public release may have private attachments accidentally included.
A PDF may have older versions or working files as attachments.
Forensic examiners can extract everything embedded.

Before publishing, audit attachments. See hidden data in PDFs explained and how to strip metadata from PDF.

Page-level FileAttachment annotations

A more focused use: a paperclip icon on a specific page, attached to a specific paragraph. Click the paperclip and the file opens. Useful for:

Footnote-style references: a small attached file for a specific claim.
Source data: charts in a report with the attached source CSV.
Supplementary materials: per-section additions.

Visibility: a small icon. Easy to miss. Mention in nearby text.

PDF/A and attachments

PDF/A (archival) restricts attachments:

PDF/A-1: no embedded files.
PDF/A-2 and PDF/A-3: allow embedded files, with conformance levels.
PDF/A-3: allows arbitrary file types (was added specifically for invoice exchange formats like ZUGFeRD, Factur-X, FattureFB).

For invoice exchange specifically:

ZUGFeRD (Germany): PDF/A-3 with embedded XML invoice data.
Factur-X (France): same idea; harmonized European standard.
PEPPOL for cross-border European e-invoicing.

These standards bridge human-readable PDFs and machine-readable invoice data in a single file. See invoice management with PDF.

Extracting attachments

Programmatic extraction:

qpdf: qpdf --list-attachments file.pdf and qpdf --extract-attachment=name file.pdf.
pdftk: pdftk file.pdf attach_files ... or unpack_files.
PDFBox, iText, pdf-lib: extract attachments via API.
mutool extract: also supports attachments in some versions.

Useful in:

Document processing pipelines that need to extract the embedded source.
Forensic analysis.
Migrating away from PDF-attachment-based delivery.

Common gotchas

Attachments not visible to viewer. The recipient doesn't see the panel; doesn't know there's anything inside. Mention in cover text.

Browser viewers hide attachments. Recipients viewing in Chrome's PDF viewer see no attachments panel. Tell them to download and open in Acrobat.

Embedded files duplicated. Some workflows embed the same files multiple times. Audit.

Large PDFs from embedded media. Easy to bloat a PDF unnecessarily.

Forgotten old versions. PDFs accidentally retain older drafts as attachments. Embarrassing.

Mismatched filenames. The internal filename and the user-visible name can differ; confusing.

Practical recipe

For useful PDF attachments:

Pick the right pattern: document-level for general; page-level for focused.
Mention attachments in the body text so users know to look.
Use compression for non-already-compressed files.
Don't embed sensitive content that shouldn't be in the public PDF.
Audit attachments before publishing.
For invoices, use PDF/A-3 with structured data (ZUGFeRD, Factur-X).
For archival, ensure the attached files are also independently archived.

For browser-based PDF assembly with attachments (combining, redacting, signing) without uploading, Docento.app handles common operations locally.

Takeaway

Embedded files are a powerful, sometimes overlooked PDF feature. For regulatory submissions, archival packages, and invoice exchange, they enable a single-file delivery model that simplifies workflows. The risks (hidden data, malware vectors) make them worth auditing before publication. For a few key workflows (especially ZUGFeRD/Factur-X invoices in Europe), attachments are essential. For most casual PDF use, they're an option to know about. See also PDF internals: objects and streams, hybrid PDF explained, and hidden data in PDFs explained.