Recommended Free Tools
For a normal in-page PDF preview, point an <iframe> at the PDF URL and put a separate open/download link next to it. The separate link is essential because an iframe has no child fallback when a browser cannot render the document.
Basic iframe embed
This is the simplest native preview. Replace /files/guide.pdf with a URL that your visitors can reach.
<iframe
src="/files/guide.pdf"
title="PDF: Guide"
width="100%"
height="600"
></iframe>
<p><a href="/files/guide.pdf">Open or download the PDF</a></p>The title identifies the document for screen-reader users; “PDF” alone is not useful context. Set a height that leaves enough room for the browser’s controls and pages. The link is outside the iframe so it remains available when the embedded viewer cannot load.
Responsive sizing
The width and height attributes are valid HTML defaults, but CSS gives you better control on narrow screens.
#1 Best Overall
.pdf-frame {
display: block;
width: 100%;
height: min(80vh, 900px);
min-height: 480px;
border: 0;
}
@media (max-width: 600px) {
.pdf-frame {
height: 75vh;
min-height: 400px;
}
}<iframe
class="pdf-frame"
src="/files/guide.pdf"
title="PDF: Guide"
loading="eager"
></iframe>loading="lazy" lets the browser defer a preview that is below the initial viewport. Use it for long pages with several documents; omit it when the PDF is the first thing users must see.
Use object when inline fallback matters
An <object> can contain fallback HTML. If the browser cannot display the PDF, the paragraph inside the element becomes the alternative content.
<object
data="/files/guide.pdf"
type="application/pdf"
width="100%"
height="600"
>
<p>
PDF preview unavailable.
<a href="/files/guide.pdf">Open or download the PDF</a>.
</p>
</object>
<p><a href="/files/guide.pdf">Open or download the PDF</a></p>data is the document URL and type="application/pdf" declares the media type. Keep the second link outside the element as well: fallback content does not cover every case in which a viewer opens but fails to display a page.
Why iframe is usually the first choice
| Element | Fallback markup | Useful controls or limits | Best fit |
|---|---|---|---|
iframe |
None inside the element; add a separate link | Supports attributes such as loading and referrerpolicy |
Most native PDF previews |
object |
Yes, as child HTML | Uses data; its source is affected by the page’s object-src policy |
A preview with inline fallback text |
embed |
No; it is a void element | width and height are absolute CSS-pixel values |
Only when a project specifically requires it |
MDN’s learning guidance names iframe as the top choice because it offers controls such as loading and referrerpolicy. That is a documentation recommendation, not a promise that every browser, operating system or mobile viewer behaves identically.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
Embed with embed (and know the trade-off)
embed can display content handled by the browser, including PDFs, but it cannot contain fallback content and offers no advantage for a normal PDF preview.
<embed
src="/files/guide.pdf"
type="application/pdf"
title="PDF: Guide"
width="100%"
height="600"
>If you use it, give it a descriptive title and provide a normal link nearby. In most cases, choose the iframe pattern instead.
Accessibility details that make the embed usable
- Write a specific iframe or embed title, such as
PDF: 2026 employee handbook, rather than “document” or “PDF.” - Keep a visible link outside the preview with an action label such as “Open or download the 2026 employee handbook (PDF).”
- Do not make the embedded frame the only way to reach the document. A keyboard user, screen-reader user or browser without a working PDF viewer needs the direct link.
- Give the frame enough height to scroll through pages without reducing it to a narrow strip. On small screens, test the layout with the CSS height reduced above.
Security and Content Security Policy
Do not add sandbox casually
Browser PDF renderers already sandbox executable PDF content. Adding an iframe sandbox attribute solely to “sandbox the PDF” can stop the built-in viewer from working and is not a portable way to restrict native PDF preview behavior. Treat sandboxing as a deliberate, tested application decision rather than a default PDF setting.
Check the directive that governs your element
A Content Security Policy can block an otherwise correct embed:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #3
- hole punched
- high quality card stock
- 4 pages
- made in USA
- keyboard shortcuts
iframesources are controlled byframe-src.objectandembedsources are controlled byobject-src.
If your policy sets object-src 'none', a native iframe is the viable native preview option. Inspect the browser console for a CSP violation and either allow the intended PDF origin under the appropriate directive or keep the direct-link-only fallback.
When a custom PDF viewer is appropriate
Use a JavaScript viewer such as PDF.js when you need a site-controlled toolbar, a consistent reading interface or behavior beyond the browser’s built-in renderer. Loading a PDF by URL can involve cross-origin (CORS) constraints, and supported PDF features vary with browser capabilities. Confirm the current PDF.js documentation for the release and deployment method you choose; do not assume that a URL which works in an iframe will automatically work in a custom viewer.
A custom viewer is a separate application layer. It does not remove the need for a direct document link, and it adds JavaScript, asset hosting and cross-origin configuration that a native iframe does not require.
Deployment checklist
- Upload the PDF at a stable, visitor-accessible URL such as
/files/guide.pdf. - Put that URL in the iframe
srcor objectdataattribute. - Add a descriptive
titleand a visible link outside the preview. - Choose a useful height; apply responsive CSS when the page can be viewed on phones.
- Check your CSP: use
frame-srcfor iframe andobject-srcfor object/embed. - Open the direct PDF link in a separate tab as a fallback test.
- Test a page where the PDF is below the fold if you added
loading="lazy". - Test keyboard access, a screen reader’s announcement of the title, and a browser or device where the native viewer is unavailable.
Troubleshooting common failures
| Symptom | Likely cause | Fix |
|---|---|---|
| Blank frame or blocked console message | CSP disallows the PDF source | Permit the source with frame-src for iframe or object-src for object/embed, or provide the direct link only. |
| “Preview unavailable” appears | The browser cannot render the PDF in that element | Use the outside open/download link. If inline fallback is important, use object with child markup. |
| Viewer does not load after adding sandbox | The sandbox restrictions interfere with the native viewer | Remove the attribute and retest; do not use iframe sandbox as a generic PDF security control. |
| Users see a 404 or an authorization page | The URL is wrong or visitors cannot access the resource | Open the exact PDF URL in a new tab while logged out as an ordinary visitor, then correct the path or access rules. |
| PDF is clipped or hard to read on mobile | Fixed desktop dimensions | Set width: 100% and use a viewport-based responsive height with a sensible minimum. |
| PDF.js reports a cross-origin error | The viewer’s request is subject to CORS rules | Serve the document from an allowed origin or configure the server according to the current PDF.js documentation; a native iframe may still work because it is a different loading model. |
| Lazy preview is not visible when expected | The frame is deferred until it nears the viewport | Scroll it into view, verify the URL, or remove loading="lazy" when immediate display is required. |
Or skip the browser setup
If your actual goal is to capture a webpage as an image or PDF rather than embed an existing PDF file, ScreenshotNeo provides a single HTTP request and an MCP server for AI clients. The API can return PNG, JPEG, WebP or PDF, while the native HTML above remains the right solution for displaying a PDF you already host.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Example cURL request (the complete parameter reference is in the ScreenshotNeo documentation):
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpCookie banners, newsletter popups and chat widgets are removed before the shot. Bot checks, blank pages and failed loads are never billed, and the response identifies the page verdict and billing result in headers. An MCP server lets AI agents such as Claude or Cursor call take_screenshot, get_page_info and capture_pdf. The Free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000 shots.
Sign up for the free ScreenshotNeo plan to try it without a card.
Bottom line
Use an iframe that points directly to the PDF, give it a meaningful title, and always place an independent open/download link beside it. Choose object when inline fallback markup is valuable, check CSP before debugging the HTML, and reserve a custom viewer for requirements that the native browser preview cannot meet.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Frequently Asked Questions
Can the embedded PDF URL be on another domain?
It can be loaded only when that URL is reachable by the visitor and your page’s security policy permits the element you chose. Test the direct URL separately and check the browser console for CSP violations.
Should I hide the direct PDF link after the preview loads?
No. Keep it available. The link is the recovery path for browsers, devices and viewer states in which the embedded preview does not display correctly.
Is an iframe preview the same as a custom PDF.js interface?
No. An iframe delegates rendering and controls to the browser’s native PDF viewer. PDF.js adds a JavaScript-rendered viewer that requires its own deployment and can encounter CORS constraints.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
