Verify a PDF — see the hidden data before you send it

What “hidden data” means in a PDF

A PDF is a container, and a lot can ride inside one without showing on the page. Some of it is the residue of editing: earlier versions of the document kept in the file’s tail, objects no viewer reaches any more, the author and software names stamped into the metadata. Some of it is active: scripts set to run when the file opens, whole other files tucked inside as attachments, layers switched off but still present. And some of it is the failure this whole practice exists to expose — text that looks removed and is not.

The text that looks removed and isn’t

A page is a list of drawing instructions. Text can be made to vanish from view while staying fully in the file: a black rectangle drawn on top of it, the same text painted white on white, text set to an invisible render mode, text shrunk to zero size, or text pushed just off the edge of the visible page. In every one of those cases the characters are still there, and they fall straight out under extraction. This tool replays each page the way a reader’s software does, and where it can, proves a glyph paints no ink by rendering the page and sampling the pixels — so “invisible” is measured, not assumed.

Presence, not absence — the honest limit, stated first

This is the line the tool will not cross: it reports presence, not absence. It can show you, with a receipt, that a given piece of hidden data is in your file. It cannot hand you a certificate that a file is clean, because a PDF is open-ended and there is always another place a byte can hide that a fixed set of checks does not cover. A QR code can be read out completely because it is a closed format; a document is not, and a tool that claimed otherwise would be selling the exact false confidence that gets people burned. So a file with nothing found is reported as “nothing found in the classes we check” — never as “clean”.

Each finding points at the fix

Findings are sorted worst-first. Text hidden in the page — under a box, off-page, invisible — routes to Redact, which deletes it from the file’s instruction list and proves its own output. The structural kinds — metadata, attachments, scripts, hidden layers, form values, prior revisions — route to Sanitize, which rebuilds the file without them and then re-inspects its own output before handing it back.

Many files at once

Drop a folder’s worth. Each file is inspected one at a time on your own device, and the result is a single ledger: how many files carry recoverable data, in how many classes, and which tool clears each. A file that is encrypted, or that cannot be parsed, is reported as exactly that — a result, not a crash, and not a false all-clear.

Questions people actually ask

What does this tool actually check for?

Recoverable hidden data: text hidden under a fill, off the page, or made invisible; prior saved versions still in the file; document metadata; embedded attachments; JavaScript and executable actions; hidden layers; form field values; unreachable leftover objects; bookmarks and fingerprints. Each is reported with what it is and how much of it there is.

Does a file with no findings mean it is safe to send?

It means nothing was found in the classes checked — presence, not absence. A PDF is an open-ended format and there is always another place data can hide, so this is never a certificate that a file is clean. It is the absence of findings, stated exactly that carefully.

Are my files uploaded to check them?

No. Every file is opened and inspected by JavaScript in your own browser tab and never leaves your device — which, for files you are checking before sending, is rather the point. Watch the Network tab and run a batch: nothing goes out.

Why is invisible text a problem if I cannot see it?

Because “cannot see it” and “is not in the file” are different facts. Text set to an invisible render mode, painted white on white, or covered by a box is still in the file’s instruction list and comes straight back out under extraction. That is the classic failed redaction, and it is exactly what this tool surfaces.

It found something — how do I remove it?

Text hidden in the page routes to the Redact tool, which deletes it and proves its own output. The structural kinds — metadata, attachments, scripts, prior revisions — are removed by rebuilding the file — the Sanitize tool, which re-inspects its own output before handing it back.