PDF Stowaway Scanner

Local PDF forensics

Find what's hiding in your PDF

White-on-white text, invisible render modes, tiny fonts, hidden layers, and prompt-injection aimed at AI reviewers. 100% local — files never leave your browser.

How it works

  1. 01

    Drop your file

    Drag a PDF onto the box or click to choose one. No account, no sign-up, no size gymnastics.

  2. 02

    Scanned locally in your browser

    The file is decoded and analyzed on your own device using WebAssembly. It is never uploaded to any server.

  3. 03

    Read the evidence

    Every piece of hidden or near-invisible text is listed with its page number and content, so you can judge each finding yourself.

What we detect

Ten kinds of hidden content, read from the file's structure rather than its rendered page.

Near-white text

Strong signal

Text colored so close to the page background that a human reader sees nothing, while an AI parsing the text layer reads it in full. White text on a white page is almost never legitimate.

Invisible render mode

Strong signal

Text drawn with PDF render mode 3, which paints no pixels at all yet stays in the machine-readable text layer. Normal authoring tools essentially never use this.

Tiny font

Text set below 4pt — too small to read on screen or in print, but fully extractable by software. Occasionally a legitimate figure callout dips this small, so read the text before judging.

Off-page text

Content hidden by cropping is surfaced through the crop box mismatch check below. Text that sits fully outside the visible page area is clipped by PDF engines — this one included — before it ever reaches text extraction, so it cannot be quoted directly here.

Crop box mismatch

The page is cropped smaller than its full media size, which can push content into the trimmed margins. Frequently benign in scanned files — inspect what falls outside the crop.

Hidden layers

Optional-content layers that are off by default or explicitly marked hidden. The layer contents stay in the file and remain readable by software even though they are not shown.

Embedded files

One or more files attached inside the PDF. Routine on engineering datasheets, unusual on papers or contracts. The names are listed below — do not open them without checking.

Embedded JavaScript

The document carries JavaScript, which can run when the file is opened in some viewers. Expected in interactive forms, out of place in a static paper or contract. It is never executed here.

Annotations

Comments and sticky notes whose text is invisible in normal rendering but still sits in the file. Often legitimate, but a classic place to hide instructions — always read the content.

Prompt injection

Text matching known patterns that try to steer an AI reviewer or summarizer — for example, telling it to ignore its instructions or return a positive verdict. Suggestive, not conclusive: a paper about prompt injection may quote such strings legitimately, so read the surrounding context.

Frequently asked questions

Is my file uploaded?
No. The scanner runs entirely in your browser using WebAssembly. Your PDF is decoded and analyzed locally on your own device and is never uploaded to any server. Nothing leaves your browser.
What can it miss?
It reads the PDF’s text layer and structure, so it cannot see text that exists only as part of an image — a scanned page or a screenshot has no text layer to inspect. It can also miss instructions phrased obscurely enough to slip past known patterns. A clean result lowers the risk but does not prove a file is safe.
Why is it free and open source?
Checking a document for hidden content should not require trusting a stranger’s server with your file. Keeping the tool free and open source means anyone can verify that it does what it claims and that nothing is uploaded. There is no account and no paywall. If page-view analytics are ever enabled, they count page views only — file contents never leave your browser.
Can I use it for résumés and papers?
Yes — those are two of the most common cases. You can check a résumé you received for hidden keywords, or scan an academic paper, contract, or report for text and instructions aimed at an AI reviewer or summarizer, all before you pass the file to any automated tool.