Security architecture · 9 min read
Can PDF Files Really Expire? Viewer Support and Security Limits
Understand what PDF expiration scripts can do, which viewers may run them, and why controlled delivery is required for reliable revocation.
Published and technically reviewed by the PDFStack Team · October 14, 2026
A downloaded file is controlled by its recipient
A PDF may include document-level JavaScript that checks a timestamp when a supporting viewer opens the file. That can trigger an alert, attempt to close the document, or call a viewer-specific editing function. It does not remove the underlying page content or prevent another application from ignoring the script.
Once a recipient has the bytes, the author no longer controls the viewer, device clock, script preference, operating system, or extraction tools. That makes standalone expiration a compatibility feature rather than a durable authorization boundary.
Viewer support changes the result
Adobe desktop products implement more of the Acrobat JavaScript API than typical browser PDF viewers. Even within Adobe products, methods have product and security restrictions. For example, Adobe documents addWatermarkFromText as unavailable in Reader, while closeDoc does not work in browser viewing contexts.
A policy should therefore name the intended viewer and be tested in that exact product. “PDF supported” is too broad because the PDF specification permits features that a viewer can ignore, disable, or sandbox.
Viewer clocks are not authoritative
Embedded JavaScript reads the recipient device time. A recipient can change that clock, open the document offline, or use software that removes the script. The PDFStack server validates that the requested UTC instant is in the future when it creates the output, but it cannot remain authoritative after the file is downloaded.
Time zones still matter for clear configuration. The tool converts the selected civil date and time in an IANA time zone to UTC, rejects nonexistent daylight-saving times, and preserves the zone for display. The embedded boundary treats the exact UTC instant as expired.
When controlled delivery is necessary
Reliable revocation requires a service that authenticates each request, evaluates policy on a trusted server clock, and withholds content after expiry. It can also revoke sessions, audit access, rotate links, and avoid giving a permanent file to unauthorized users.
PDFStack does not introduce that storage and delivery platform in this feature. Use the viewer policy only when a best-effort notice or compatible-viewer behavior is acceptable, and use controlled delivery for confidential or regulated material.
Frequently asked questions
Will a browser PDF viewer enforce the policy?
Usually not. Common browser viewers do not execute Acrobat document JavaScript.
Can the recipient bypass a viewer policy?
Yes. Changing viewers, disabling scripts, changing the device clock, or extracting content can bypass it.