There’s a running joke in computing that DOOM will eventually run on everything. Not as a boast about the game, but as a challenge: the 1993 shooter has been made to run on cash machines, printers, pregnancy tests, calculators, a single LEGO brick and the touch bar of a MacBook.
In January 2025 a high-school student added a new one to the list. They got DOOM running inside a PDF file.
It’s a wonderful piece of work and a very good joke. It’s also the single clearest demonstration of something this site keeps arguing, and which people reasonably find hard to believe: a PDF is not a picture of a page. It’s a container that can run code.
How it actually works
The project is called doompdf, by a developer who goes by ading2210. The mechanism is more interesting than the stunt.
PDF supports JavaScript. Not as an add-on or a plugin — it’s part of the format, with its own standard library, and browsers implement it in their built-in PDF engines. It exists so that forms can validate what you type and interactive documents can respond to clicks.
DOOM’s source code is public. id Software released it in 1997, which is why the game keeps turning up in unlikely places.
The two were bridged with a compiler. ading2210 used an older version of Emscripten to compile DOOM’s C code into asm.js — a restricted dialect of JavaScript — so it could run inside the limited environment a PDF provides.
Then there’s the display, which is the part that makes people laugh out loud. A PDF has no screen to draw on. What it does have is form fields. So the game’s 320×200 output is rendered as ASCII characters, one text field per row of the screen, in six shades of grey. You are, quite literally, playing DOOM in a fillable form.
It runs slowly. It’s monochrome. It’s completely playable, and you can try it yourself in a Chromium-based browser.
The same developer later went further and ran a Linux kernel inside a PDF, using a RISC-V emulator. At that point the joke has stopped being a joke and started being a statement about the format.
The part that isn’t funny
Here’s the thought worth sitting with. Nothing in doompdf is an exploit. No vulnerability was found, nothing was broken, no security hole was involved. Every single thing it uses is a documented, intended feature of the PDF specification, working exactly as designed.
Which means the capability that lets a PDF run a 1993 first-person shooter is present in the invoice you’ll open tomorrow. Not lurking, not hidden — just there, unused, because most documents have no reason to use it.
If a document can run a game, it can run other things. And once you accept that, a few pieces of standard security advice stop sounding paranoid and start sounding obvious:
- A PDF can carry instructions that execute the moment it opens, before you have read anything.
- A PDF can reach out to the internet on its own, confirming to whoever is on the other end that you opened it.
- A PDF can behave differently depending on which software opens it.
None of that makes PDFs dangerous in any everyday sense. You will open dozens this month and every one will be fine. It does mean the mental model most of us carry — “it’s just a document” — is wrong in a way that occasionally matters.
What to do with this information
The practical response is small and worth the ten minutes.
Turn off JavaScript in your PDF reader. In Adobe Acrobat Reader it’s under Preferences → JavaScript. Almost nobody knowingly uses a scripted PDF in ordinary work. Switching it off removes an entire category of risk and costs you nothing except, admittedly, the ability to play DOOM in a form field.
Keep the reader updated. Scripting is one route in. Flaws in the code that decodes fonts and images are another, and those are what updates fix.
Treat unexpected documents as unexpected. An invoice from a company you have never bought from deserves a moment’s thought, whatever format it arrives in.
Notice what all three have in common: none requires you to stop using PDFs, or to be suspicious of documents generally. They’re the equivalent of locking your front door — cheap, boring, and sensible precisely because the risk is small but non-zero.
Why this project deserves the attention it got
It would be easy to file doompdf under “internet curiosity” and move on. I’d argue it’s more useful than that, for a reason that has nothing to do with security theatre.
Most people’s understanding of file formats is built entirely on what the formats are used for. Documents are for reading. Spreadsheets are for numbers. Images are for looking at. That model works nearly all the time, which is exactly why it’s so hard to dislodge — and why explaining “a PDF can contain active content” tends to be met with polite scepticism.
A playable game inside a document does in ten seconds what an article struggles to do in a thousand words. It replaces an abstract claim with something you can click.
And the deeper point holds well beyond PDFs. Formats accumulate features over decades. Each addition made sense to someone solving a real problem. The result is that the ordinary things we exchange every day are considerably more capable than their names suggest — and capability, once it exists, is available to everyone.
Where this leaves the everyday stuff
Nothing here is an argument against PDF. It remains the best format there is for sending a document that will look the same everywhere, on any machine, years from now. That’s a genuinely hard problem, and PDF solved it.
It’s an argument for knowing what you’re handling. The same versatility that lets a document carry a game also lets it carry scripts, attachments, hidden layers and metadata you never intended to send. Those are worth understanding, and none of them are reasons for alarm.
It’s also part of why PDF Manipulator runs entirely on your own computer. When you’re merging, splitting or converting files, the fewer parties involved the better — not because online services are sinister, but because a document that never left your machine is a much simpler thing to reason about than one that has been on somebody else’s server.
The short version
A high-school student compiled DOOM into JavaScript and ran it in a PDF using form fields as a display. No vulnerability was involved — every feature it uses is a normal part of the format. That’s the interesting bit. If a document can run a game, it’s worth spending ten minutes on your reader settings and then getting on with your life.
Work with your PDFs entirely offline — PDF Manipulator is free →
Sources
- ading2210, doompdf on GitHub — technical write-up and source code
- Playable version (Chromium-based browsers)
- TechSpot, Latest Doom port runs inside a PDF document
