Free tool · runs in your browser · nothing uploaded
Did your redaction actually work?
Drag in a PDF you've already "redacted." In a second or two you'll know whether the sensitive text is still sitting in the file, underneath the black boxes. The document never leaves your machine.
There's no upload and no server to send it to — this is a static page. The scanner is a WebAssembly build of Omitly's engine that runs inside your browser, reads the PDF into the page's own memory, and discards it when you close or reload. Nothing is stored, logged, or transmitted. Verify it yourself: turn off Wi-Fi, then drop a file — it still works. Or open your browser's Network tab and watch: no request goes out.
Quick walkthrough
Check a redacted PDF in under a minute
See how the browser leak checker uses a deliberately leaky sample, reports recoverable values, and masks the sensitive details.
Pattern-based checks can miss names, addresses, unusual formats and image-only text. No findings is not a guarantee that a PDF is fully redacted.
Why a black box isn't redaction
A drawn rectangle sits on top of the text. The characters are still in the PDF's content stream — selectable, copyable, extractable.
It re-reads the file in your browser and pattern-matches for emails, SSNs, phone and card numbers that survived — in the page text, in superseded prior saves of the file, in metadata, form fields, attachments and annotations. Masked, never shown raw.
Omitly removes the underlying data, verifies each region is empty, and writes a signed audit log — on-device. A black box can't do that.
Questions
How can a redacted PDF still contain the data?
Most tools — and most people — 'redact' by drawing a black rectangle over the text. The rectangle is just a shape painted on top; the original characters are still in the file's content stream. Anyone can select, copy, or extract them. True redaction removes the underlying bytes, which is what Omitly does.
Is my document uploaded anywhere?
No. The checker is a WebAssembly build of Omitly's detection engine that runs entirely inside your browser tab. Your PDF's bytes are read into the page's memory and scanned locally — nothing is sent to a server. You can disconnect from the internet and it still works.
Does it show the actual sensitive values?
No. It shows the masked shape (e.g. •••-••-6789) and where each item sits, so you can confirm a leak without the raw value ever being displayed. The same privacy-by-default principle runs through all of Omitly.
What does 'clean' mean here?
It means the pattern-based scan (emails, SSNs, phone numbers, card numbers) found no recoverable matches on any surface it inspected: the page text (including text split across operators or encoded with embedded-font character maps, as Chrome's print-to-PDF writes it), superseded prior revisions of the file, document metadata, form-field values, attachments, embedded form graphics and annotation appearances. The result card lists exactly what was and wasn't inspected. It is still not a guarantee of completeness — names, addresses and image-only text aren't caught by patterns. To actually remove data and get a verified, audited result, use the Omitly app.
How do I fix a leaking PDF?
Open it in Omitly. It removes the underlying text and image data (not a box over it), independently verifies nothing survives in each region, and writes a signed audit log — all on your machine.