What are PDF attachments?

PDF attachments are files embedded inside a PDF document. They are stored as EmbeddedFile stream objects — self-contained binary data streams that can be any file type: XML, Excel, Word, images, ZIP archives, audio. Attachments are referenced via file specification dictionaries and can be accessed at the document level (via the Names tree) or at a specific page location (via FileAttachment annotation objects).

What is the difference between a document-level attachment and a FileAttachment annotation?

Document-level attachments are listed in the PDF's document catalog Names tree — they are accessible via the PDF viewer's Attachments panel and are not tied to any specific page or position. FileAttachment annotations are pinned to a specific location on a specific page — displayed as a paperclip or push-pin icon where the file is relevant. Both use the same underlying EmbeddedFile stream; the difference is how they are referenced and where they appear in the viewer.

What is a PDF Portfolio?

A PDF Portfolio (also called a PDF Package) is a special container PDF that bundles multiple files — PDFs, Word documents, Excel spreadsheets, images, or any file type — into a single PDF file. Each contained file is stored as an embedded file and displayed in a built-in portfolio navigator. The portfolio PDF itself typically contains a cover sheet and a navigation UI; the component files are displayed inside an embedded viewer. Adobe Acrobat's Portfolio feature implements this; simpler implementations just embed files without the portfolio UI.

Can PDF attachments contain malware?

Yes. PDF attachments can be any file type, including executable files (.exe, .bat, .js). A PDF could embed a malicious executable that a user is prompted to open. Modern PDF viewers warn users before opening attached files and prevent automatic execution. Enterprise security policies typically block execution of attachments from PDFs. PDF/A-3's permission of attachments is the reason some security policies restrict PDF/A-3 in favour of PDF/A-2 for archiving.

How does PDF/A-3 use attachments for e-invoicing?

PDF/A-3 allows any file type to be attached to an archival PDF. ZUGFeRD and Factur-X e-invoicing standards use this to create hybrid documents: the PDF/A-3 file contains the human-readable invoice as the visible PDF page and a machine-readable XML (ZUGFeRD XML or EN 16931-compliant Factur-X XML) as a document-level embedded file. ERP systems and accounting software process the XML automatically; humans read the PDF. One file serves both purposes.

What file types can be embedded as PDF attachments?

Any file type can be embedded in a PDF attachment — there is no restriction at the PDF specification level. Common attachment types include: XML (e-invoice data), Excel/CSV (tabular source data), Word (source documents), images (original photos), ZIP archives (multiple files), audio/video (for rich media PDFs), and CAD files (in engineering PDFs). The EmbeddedFile stream stores raw binary data regardless of content type.

PDF Attachments Explained: Embedded Files, File Specs & Portfolio PDFs

Quick Answer

A PDF attachment is any file — XML, Excel, Word, ZIP, image — embedded inside the PDF file itself as a self-contained binary data stream. Unlike an attachment in an email (a separate file that can be lost), a PDF attachment travels with the PDF no matter where the file goes. There are two ways a file can be attached: as a document-level attachment (listed in the PDF viewer's Attachments panel, accessible from anywhere in the document) or as a FileAttachment annotation (a paperclip icon pinned to a specific location on a specific page). The embedded file itself — the actual bytes of the attached file — is stored identically in both cases as an EmbeddedFile stream in the PDF.

How PDF Attachments Work

PDF attachments are stored using two key structures:

EmbeddedFile stream — A PDF stream object containing the raw binary data of the embedded file, with a /Params sub-dictionary storing file metadata: original filename, file size, creation date, modification date, and an MD5 checksum for integrity verification.
File Specification dictionary — A wrapper dictionary that names the embedded file (/F, /UF), specifies its MIME type (/Subtype), and points to the EmbeddedFile stream (/EF). File Specification dictionaries are what the document catalog and FileAttachment annotations reference.

Documents reference file specifications in two ways:

Document-level (EmbeddedFiles name tree) — Listed in the document catalog's /Names/EmbeddedFiles name tree. Accessible via the viewer's Attachments panel; not tied to any page or position.
FileAttachment annotation — A Widget-like annotation with a paperclip or push-pin icon rendered on a specific page at a specific location, pointing to its File Specification dictionary via the annotation's /FS key.

📌

PDF/A-3 and attachments: PDF/A-1 and PDF/A-2 prohibit embedded files entirely. PDF/A-3 (ISO 19005-3) specifically permits embedded files of any type — this was introduced to enable ZUGFeRD and Factur-X hybrid e-invoices, where the human-readable PDF/A-3 document carries a machine-readable XML invoice as an embedded attachment.

Attachment Types Compared

Type	Location in PDF	Viewer UI	Best For
Document-level attachment	Names/EmbeddedFiles tree	Attachments panel / paperclip icon	Supporting files for the whole document
FileAttachment annotation	Page /Annots array	Paperclip/pin icon on page	Files relevant to specific page content
PDF Portfolio component	Names/EmbeddedFiles + /Collection metadata	Portfolio navigator UI	Multi-document packages with custom layout
PDF/A-3 embedded XML	Names/EmbeddedFiles with AFRelationship	Attachments panel	ZUGFeRD / Factur-X e-invoicing

Real-World Examples

🧾 E-Invoicing Scenario

ZUGFeRD Invoice: PDF + XML in One File

A German manufacturer's ERP system generates ZUGFeRD invoices. Each invoice is a PDF/A-3 document: the visible page shows the human-readable invoice with all line items, totals, and bank details formatted for the customer's accounts payable team. Embedded as a document-level attachment is a ZUGFeRD-compliant XML file containing every line item, price, tax code, payment term, and IBAN in structured machine-readable format. The customer's ERP system automatically extracts the XML and books the invoice without any manual data entry. The PDF serves the human; the XML serves the machine. One email attachment does both.

🏗️ Engineering Scenario

Technical Drawing: CAD File Attached at Annotation Point

An engineering firm delivers a PDF drawing of a structural floor plan with FileAttachment annotations at key structural points. Clicking the paperclip at the beam junction on page 3 opens the original AutoCAD .DWG file for that beam specification. At the stairwell detail on page 7, another FileAttachment opens the full BIM model for that section. Reviewers and contractors can open the CAD/BIM source files directly from the relevant point in the drawing — no separate directories, no file naming conventions, no "where's the DWG for Section 3?" emails.

📁 Portfolio Scenario

Tender Response: PDF Portfolio with 8 Component Documents

A consulting firm submits a tender response as a single PDF Portfolio. The portfolio cover PDF provides navigation; eight component documents are embedded as attachments: the main proposal PDF, a financial spreadsheet, three reference letters (PDFs), a methodology diagram, a team CV document, and a compliance checklist. The client opens one file and accesses all eight documents through the embedded portfolio navigator — no zip file, no "please find attached" confusion, no missing attachments. The PDF Portfolio is a single-file submission package that any PDF viewer can open.

Why PDF Attachments Matter

📦

Self-Contained Files

Attached files travel with the PDF — no separate directories, no version confusion, no missing files. A PDF with its data attachment is a complete, standalone information package.

🤖

Machine + Human Readable

PDF/A-3's embedded XML attachments (ZUGFeRD, Factur-X) let one file serve both machine processing and human reading — the XML for ERP automation, the PDF for human review.

📌

Contextual Linking

FileAttachment annotations pin supporting files to specific page locations — CAD files at drawing details, spreadsheets at data tables, source documents at relevant sections.

✅

Integrity Verification

EmbeddedFile streams store MD5 checksums of the attached file — allowing programs to verify that the attachment hasn't been corrupted or tampered with since it was embedded.

🗃️

PDF Portfolio Packages

PDF Portfolios bundle multiple files of different types into one navigable PDF container — ideal for tender submissions, client deliverable packages, and multi-document archives.

🏛️

Archival Data Inclusion

PDF/A-3 explicitly permits attachments for long-term archival — ensuring the source data (XML, spreadsheet) is preserved alongside the rendered human-readable document for future reference.

File Specification Dictionary Structure

PDF — FILE SPECIFICATION + EMBEDDEDFILE STREAM

% File Specification dictionary
<<
  /Type    /Filespec
  /F       (invoice-data.xml)        % file name
  /UF      (invoice-data.xml)        % Unicode file name
  /AFRelationship /Data             % PDF/A-3 relationship
  /EF      << /F 12 0 R >>          % EmbeddedFile stream ref
>>

% EmbeddedFile stream (12 0 R)
<<
  /Type    /EmbeddedFile
  /Subtype (application/xml)
  /Params
  <<
    /Size      14832
    /CreationDate (D:20260312120000Z)
    /CheckSum  <a3f82b...>           % MD5 integrity hash
  >>
>>
stream
  % Raw XML invoice bytes (compressed)
endstream

Common Mistakes to Avoid

Embedding attachments in PDF/A-1 or PDF/A-2 documents. Embedded files are prohibited in PDF/A-1 and PDF/A-2. Only PDF/A-3 allows embedded files. If you need to attach XML data (e.g., ZUGFeRD) to a conformant archival PDF, you must use PDF/A-3. Embedding files in PDF/A-1b or PDF/A-2b will cause compliance failures in veraPDF and PAC 2024 validation.
Not specifying the AFRelationship for PDF/A-3 attachments. PDF/A-3 requires the /AFRelationship key on each file specification dictionary — indicating the relationship between the attachment and the document. Valid values: /Source (the document was generated from this file), /Data (machine-readable data equivalent), /Alternative (alternative rendering), /Supplement, /Unspecified. Missing /AFRelationship is a PDF/A-3 validation error.
Assuming all PDF viewers show attachment panels. Browser-based PDF viewers (Chrome, Firefox) typically do not show attachment panels or allow extraction of attached files. If attachments are critical to your workflow, instruct recipients to use Acrobat, Foxit, or PDF-XChange. For machine processing (ZUGFeRD), the receiving ERP system must be able to parse the attachment programmatically.
Embedding executable files in PDFs. Embedding .exe, .bat, .ps1, or .jar files in PDFs is a significant security risk. Many enterprise PDF security policies block opening attachments with executable extensions. While the PDF specification permits any file type, best practice is to limit attachments to data formats (XML, CSV, PDF, DOCX) and inform recipients of what is attached.
Using FileAttachment annotations without flattening for archiving. FileAttachment annotations, like all annotations, can be deleted from PDFs. For archival PDFs where the attachment must always be present, use document-level EmbeddedFiles name tree references — these are not visible as deletable page annotations and are harder to accidentally remove.

Frequently Asked Questions

PDF attachments are files embedded inside a PDF as EmbeddedFile stream objects — any file type, fully portable. They can be document-level (listed in the Attachments panel, not tied to a page) or FileAttachment annotations (paperclip icons pinned to a specific page location).
Document-level attachments are in the Names/EmbeddedFiles tree — accessible from the Attachments panel, with no page association. FileAttachment annotations are pinned to a specific page location with a visual paperclip or push-pin icon. Both use the same EmbeddedFile stream structure.
A PDF Portfolio bundles multiple files of any type into a single PDF container with a navigable UI. Component files are stored as EmbeddedFile streams with /Collection metadata defining the portfolio layout. Perfect for multi-document submissions, tender responses, and client deliverable packages.
PDF/A-3 allows any file type as an embedded attachment. ZUGFeRD and Factur-X e-invoices use this to embed machine-readable XML in the PDF/A-3 document alongside the human-readable invoice. ERP systems process the XML automatically; humans read the PDF. One file serves both purposes with /AFRelationship /Data declared.
Yes. Any file type can be embedded, including executables. Modern PDF viewers warn before opening attachments of risky types. Enterprise policies block executable extensions. Best practice: only embed data formats (XML, CSV, PDF, DOCX); never embed .exe or script files in PDFs you distribute.
Printing a PDF does not include attached files — only the visible page content prints. Converting a PDF to another format (Word, HTML) typically strips embedded attachments. Attachments are only preserved when working with the PDF file directly in a viewer or programmatically processing the PDF file. Always keep the original PDF to retain access to attachments.

Merge, Manage & Package PDFs — Free

PDFlyst makes it easy to organise, combine, and work with PDF documents and their content.

Merge PDFs — Free

PDF Attachments: Embedded Files, Specs & Portfolio PDFs