Free tool · runs in your browser · nothing uploaded
Did your redaction actually work?
Drag in a PDF you've already "redacted." In a second or two you'll know whether the sensitive text is still sitting in the file, underneath the black boxes. The document never leaves your machine.
There's no upload and no server to send it to — this is a static page. The scanner is a WebAssembly build of Omitly's engine that runs inside your browser, reads the PDF into the page's own memory, and discards it when you close or reload. Nothing is stored, logged, or transmitted. Verify it yourself: turn off Wi-Fi, then drop a file — it still works. Or open your browser's Network tab and watch: no request goes out.
Why a black box isn't redaction
A drawn rectangle sits on top of the text. The characters are still in the PDF's content stream — selectable, copyable, extractable.
It re-extracts the text layer in your browser and pattern-matches for emails, SSNs, phone and card numbers that survived. Masked, never shown raw.
Omitly removes the underlying data, verifies each region is empty, and writes a signed audit log — on-device. A black box can't do that.
Questions
How can a redacted PDF still contain the data?
Most tools — and most people — 'redact' by drawing a black rectangle over the text. The rectangle is just a shape painted on top; the original characters are still in the file's content stream. Anyone can select, copy, or extract them. True redaction removes the underlying bytes, which is what Omitly does.
Is my document uploaded anywhere?
No. The checker is a WebAssembly build of Omitly's detection engine that runs entirely inside your browser tab. Your PDF's bytes are read into the page's memory and scanned locally — nothing is sent to a server. You can disconnect from the internet and it still works.
Does it show the actual sensitive values?
No. It shows the masked shape (e.g. •••-••-6789) and where each item sits, so you can confirm a leak without the raw value ever being displayed. The same privacy-by-default principle runs through all of Omitly.
What does 'clean' mean here?
It means the pattern-based scan (emails, SSNs, US phone numbers, 16-digit card numbers) found no recoverable matches in the text layer. It is not a guarantee of completeness — names, addresses and image-only text aren't caught by patterns. To actually remove data and get a verified, audited result, use the Omitly app.
How do I fix a leaking PDF?
Open it in Omitly. It removes the underlying text and image data (not a box over it), independently verifies nothing survives in each region, and writes a signed audit log — all on your machine.