Dangerzone is a free, open-source desktop application that converts potentially dangerous documents into PDFs on the user’s computer. It opens the untrusted content inside layered isolation, turns each page into raw pixel data, and rebuilds a new PDF outside the document-processing sandbox.
This review checks Dangerzone 0.11.0 against the project’s current website, repository, installation guide, and published security explanation as of August 30, 2026. It does not claim that Top5soft tested malicious documents or measured conversion speed.
Correction published August 30, 2026: The previous edition claimed hands-on testing, “bulletproof” and “absolute” safety, no false negatives, fixed conversion times and output sizes, no command-line interface, and a Cure53 audit. It also incorrectly associated the project with Signal and used legacy generated media. This edition removes those claims and images and documents the actual Include Security audit and residual risks.
What Dangerzone does
Dangerzone is maintained by the Freedom of the Press Foundation, the nonprofit that also maintains SecureDrop. The project is not the organization behind Signal. It is released under the AGPLv3 license and is currently available for Windows, macOS, several Linux distributions, Tails installation, and beta Qubes OS support.
The tool is designed for documents that a recipient needs to read but does not trust enough to open directly in an ordinary office suite or PDF viewer. It supports PDFs, Microsoft Office and OpenDocument formats, EPUB, common image types, and several related formats listed on the official About page. The output is a PDF rather than an editable copy of the original file.
Dangerzone is not an antivirus verdict service. It does not say that the source document is clean, identify a malware family, or provide a process and network report. It reduces risk by moving only rendered page data across the isolation boundary and rebuilding a new document.
How the conversion works
The current technical description documents this sequence:
- The original document enters the sandbox through standard input.
- LibreOffice or PyMuPDF converts it to PDF when needed.
- PyMuPDF splits the PDF into pages and renders them as raw RGB pixel data.
- The sandbox writes the page count and pixel data to standard output, then exits.
- The host reconstructs the pixels as a compressed PDF.
- Optional OCR can add a searchable text layer.
The reconstructed PDF does not preserve the original document’s macros, scripts, forms, embedded objects, or editability as live components. That is the core security trade-off. Visual content can remain readable, while active content and original structure are discarded.
OCR is optional, so text selection depends on that choice and language support. The rebuilt page is still a rendering: complex layouts, accessibility structure, hyperlinks, comments, spreadsheet formulas, animations, and editable fields should not be expected to survive as they did in the source.
The previous article supplied page timings and file-size multipliers without a test record. Conversion time and output size depend on page count, resolution, OCR, document complexity, hardware, and format, so this edition does not invent universal numbers.
Isolation layers and residual risk
Dangerzone treats the document converter as untrusted. The current design runs the processing workload inside gVisor, which is itself inside a Linux container. The container has no network access and does not mount the host filesystem. On Windows and macOS, Podman runs the containers inside a dedicated virtual machine; current releases hide most of that setup from the user.
This layered design raises the cost of escaping. The project explains that an attacker may need a document-renderer exploit, a gVisor escape, and then a Linux-container or kernel escape to reach the host. “May need” is not the same as “cannot.” New vulnerabilities can appear in LibreOffice, PyMuPDF, gVisor, Podman, Linux, or the surrounding application.
The official page also warns about operating-system previews. A file manager may generate a thumbnail or side-panel preview before Dangerzone receives the document. That code path is outside Dangerzone’s conversion sandbox. Keeping the operating system current and disabling risky preview behavior where practical remains part of the threat model.
Dangerzone’s December 2023 assessment was performed by Include Security with Open Technology Fund support. The project says the audit found no high-risk issues, plus three low-risk and seven informational findings. That is useful independent evidence about the reviewed version and scope; it is not a permanent guarantee for later releases or every platform.
Current version, platforms, and installation
Dangerzone 0.11.0 is the current release in the official repository. The installation guide documents Windows installers, signed macOS packages for Intel and Apple silicon, Debian or Ubuntu packages, Fedora packages, Tails instructions, and beta Qubes OS support.
The project signs release artifacts and publishes the Dangerzone release-key fingerprint. Users with a higher-risk threat model can verify the package signature against the fingerprint shown on the official site and repository instructions.
Starting with the current packaging model, ordinary Linux packages can download the signed conversion-container image on first use and keep it updated. The larger dangerzone-full packages bundle that image for offline or air-gapped installation. Windows and macOS packages include the application and its Podman-based runtime path; users do not need to follow the old article’s generic Docker Desktop instructions.
An initial image download or update does require network access unless a full offline package is used. Document conversion itself is designed so the untrusted sandbox has no network access. Those are different statements: “offline conversion” does not mean every installation and update workflow is permanently network-free.
Updates and supply-chain controls
Keeping Dangerzone current is part of its security model. Version 0.10 introduced independently updated conversion-container images. The project’s update design article describes signed images, provenance attestations, and reproducible-build goals.
This separation allows the high-risk document-processing environment to receive updates without waiting for a complete desktop application release. It also creates an operational requirement: teams using offline packages need a scheduled process to obtain, verify, test, and deploy new application and container versions.
Reproducible and signed artifacts reduce some supply-chain risks, but they do not remove the need to trust the signing process, release infrastructure, dependencies, and local installation path. Organizations should record the installed application version, container version, package source, and last update date.
GUI and command-line workflows
The desktop interface provides the normal single-user workflow: select one or more supported documents, choose an output, optionally enable OCR, and convert. The project can archive the unsafe original in a separate subdirectory rather than deleting it.
Contrary to the old Top5soft article, Dangerzone includes a command-line program. The official repository defines dangerzone-cli and exposes options for output filename, OCR language, archiving, container runtime, debugging, and multiple input files. The CLI source is the clearest current reference, although the project acknowledges that end-user CLI documentation remains limited.
CLI availability makes controlled batch processing possible, but it is not a turnkey mail gateway or enterprise document pipeline. Administrators still need queue isolation, resource limits, file-type policy, output validation, logging, update management, and a safe place for originals. Do not wrap the CLI in a public upload service without designing those controls.
Strengths and limitations
Documented strengths
- Processes supported documents locally instead of requiring a cloud scanner.
- Moves raw page pixels, rather than the original document structure, out of the untrusted sandbox.
- Uses gVisor, a Linux container, disabled sandbox networking, and no host-filesystem mount as layered controls.
- Supports more than 20 document and image formats.
- Offers optional OCR for searchable output.
- Provides signed releases, update mechanisms, source code, and an AGPLv3 license.
- Includes both GUI and command-line entry points.
- Has a published independent security review.
Important limitations
- Output is a reconstructed PDF, not an editable version of the original.
- Complex layout, links, accessibility structure, forms, comments, formulas, and multimedia can be lost.
- It does not identify malware or produce behavioral indicators.
- Operating-system preview code can touch the original file outside Dangerzone.
- The isolation stack can still contain vulnerabilities.
- OCR, conversion, and large documents consume local CPU, memory, storage, and time.
- CLI automation requires additional operational controls.
- Offline deployments need a deliberate update process.
Alternatives
The source-verified file scanner guide separates sanitization from reputation and behavioral analysis.
VirusTotal provides broad reputation and analysis context. Standard submissions have sharing implications and do not create a locally sanitized PDF.
MetaDefender Cloud combines multiscanning, Deep CDR, DLP, sandboxing, and APIs. It fits managed cloud or enterprise file-processing workflows, with privacy depending on license and mode.
OPSWAT File Security for Browser adds MetaDefender checks to Chrome and Edge downloads. Cloud analysis can upload the complete file, unlike Dangerzone’s local conversion path.
ANY.RUN is an interactive malware sandbox for trained analysts. It helps investigate behavior rather than producing a document intended for ordinary reading.
Hybrid Analysis is a public automated sandbox and community research service. It should not receive confidential documents.
Verdict
Dangerzone is a strong fit when the task is to read a supported untrusted document while preserving local custody and discarding active document structure. Its pixel-transfer design, gVisor and container layers, network-disabled processing, signed releases, and public audit provide a clear and inspectable security model.
It should not be sold as bulletproof. The original file may encounter operating-system preview code, every isolation layer can have vulnerabilities, and the output can lose important document semantics. High-risk users should keep the operating system and Dangerzone images current, verify releases where appropriate, handle originals carefully, and inspect the reconstructed PDF before relying on it.
Best fit: journalists, researchers, legal teams, and other users who need a local readable PDF from an untrusted supported document.
Poor fit: workflows requiring editable Office output, malware-family identification, executable analysis, rich document fidelity, or a fully managed enterprise gateway.
Frequently asked questions
Is Dangerzone free?
Yes. Dangerzone is free and open source under AGPLv3. The project does not advertise a paid feature tier.
Does Dangerzone work offline?
Document conversion is designed to run locally with no network access inside the untrusted sandbox. Ordinary packages may need to download or update the container image; dangerzone-full packages are intended for offline or air-gapped installation.
Is the output guaranteed safe?
No security tool can make that guarantee. Dangerzone reduces risk through rendering, pixel transfer, and layered isolation, while its own documentation identifies sandbox-escape and operating-system-preview risks.
Does Dangerzone have a CLI?
Yes. The project includes dangerzone-cli, with options for output filename, OCR, archiving, runtime selection, and multiple files. End-user documentation is less polished than the GUI path.
What happened in the security audit?
Include Security reviewed Dangerzone in December 2023. The project reports no high-risk findings, three low-risk findings, and seven informational findings in that assessment.
