What is PDF Privacy & Metadata Risk Scanner?
PDF Privacy & Metadata Risk Scanner is a free, browser-based tool that checks a PDF for sensitive personal data hiding in its text and for metadata that could expose who created it. It scans each page's visible text layer for US Social Security numbers, Indian Aadhaar and PAN numbers, credit/debit card numbers (validated with the Luhn checksum), email addresses, phone numbers and IPv4 addresses, then reads the document's metadata (title, author, creator, producer, keywords, dates), XMP packet, annotations and script actions. Every match is partially masked and tied to its page so you can review it safely. All processing runs entirely in your browser — your PDF never leaves your device.
Common Use Cases
Pre-Sharing Privacy Check
Run the scan before emailing, publishing, or uploading a PDF to catch SSNs, card numbers, or personal details that slipped into the text.
Metadata Leak Audits
See which author, creator, producer, and keyword fields are populated — the kind of metadata that can identify a document's origin when you share or publish it.
QA & Test Data Review
Confirm that test PDFs or sample exports do not contain live-looking PII patterns before using them in demos, issue reports, or public documentation.
Document Sanitization Prep
Locate sensitive content that should be redacted or removed before running a redaction or metadata-stripping pass.
How to Use This Tool
- Drop a PDF (up to 100MB) onto the upload zone — it never leaves your browser
- The scan runs locally in three steps: text layout, sensitive-pattern scan, then metadata and document-internals analysis
- Review the summary cards for high-risk matches (SSN, Aadhaar, PAN, cards), medium-risk (email, phone, IP) and metadata exposure
- Expand any flagged category to see the pages it appears on plus masked sample values for safe review
- Read the Metadata & document internals table for populated author/creator/producer/keywords fields and hidden-content flags
- Export a JSON report or copy a plain-text summary if you need to keep a record — matches stay masked