Home / Free tools / PDF X-Ray
Free · no account

What is this PDF hiding?

A PDF is not a picture of a page — it is a container with a history. Edits are usually appended rather than overwritten, which means the version before the edit is often still inside the file. Upload one here and see its saved revisions, the values an earlier revision carried, hidden and covered text, and the structural traces an edit leaves whether or not anyone meant to leave them.

Live analysis

X-ray a PDF

Free checks available today

Analysis runs in an isolated worker with a hard time limit, so a hostile file can never reach the rest of the system. Expect a few seconds.

§01 / WHAT IT READS
Structure, not claims

The parts of the file a reader never sees.

Saved revisions

Incremental updates

Every appended revision still recoverable inside the file, with how many bytes each one added and which pages it touched — the document's own edit log, written by the format itself.

Recovered values

Before and after

Where an earlier revision's text is still physically present, the previous value shown beside the current one, with the page it sits on and how it was reconstructed.

Hidden and covered text

Optional content

Text rendered invisibly, clipped off-page, or covered by a shape drawn over it — including optional-content layers that can be switched off, and what they were hiding.

Construction pattern

Origin

Whether the pages are native digital text, a searchable scan, a pure raster capture, or a mix — derived from the pixels and the page tree, never from the Producer string.

Signature coverage

Integrity

Which revision each signature actually seals, and whether any bytes were appended after the range it covers — the difference between “signed” and “signed and then changed”.

A transformation timeline

Narrative

The events the evidence supports, in order, with what each one is based on — observations separated from interpretation, and competing explanations kept on the table.

§02 / WHY IT WORKS
The format's own memory

Editing a PDF usually adds to it.

When you change a PDF and save, most software does not rewrite the document. It appends: the new version of each changed object goes on the end of the file, followed by a fresh cross-reference table pointing at the new objects instead of the old ones. The old objects are still there. They are simply no longer referenced.

This design exists for good reasons — it makes saving fast, and it is what lets a digital signature keep sealing the exact bytes it signed while later annotations pile up behind it. But it has a side effect that document examiners have relied on for twenty years: an appended edit leaves the pre-edit document inside the file.

So a PDF that was altered after issue frequently still contains the original amount, the original date, the original payee. Reconstructing the earlier cross-reference table and following it to the objects it pointed at is what “recovered values” means on this page. When it works, it is about as close to proof as document forensics gets: not an inference from a suspicious font, but the previous text, physically present, in the file the sender handed you.

And when it doesn't work

Plenty of workflows fully rewrite the file — printing to PDF, flattening, running it through an optimizer, or exporting from a tool that always writes a fresh document. That destroys the appended history, and no amount of analysis brings it back. A file with one revision and no recoverable prior state is completely ordinary, and it is not evidence of anything.

That is why the result separates what was observed from what it might mean, keeps competing explanations visible, and reports what could not be checked instead of quietly scoring it as clean.

§03 / READING IT

How far the result goes

It cannot tell you a document is genuine. Structure is one layer of five, and it is silent about whether the invoice matches a real purchase order, whether the company on the letterhead exists, or whether the numbers add up. A structurally pristine PDF can be a complete fabrication produced in one pass by someone who never edited anything.

It also cannot tell you who made a change or why. Revisions carry no identity. An edit after signing might be fraud, or it might be the recipient adding an annotation — the evidence shows what happened to the bytes, and the judgement is yours.

What we do with what you paste

Nothing is saved. The free tools hold your input for the length of the request and drop it with the response — no stored report, no archived file, no record of the URL, the message or the filename. The only thing we keep is an anonymous count so the daily allowance means something, and it is a number, not an identity.

Everything you see comes from deterministic analysis: public registration records, live DNS and TLS handshakes, header parsing and PDF structure. The same engines answer the same way whether or not you have an account.

§ MORE FREE TOOLS
No account needed

Two more you can use right now.

Related reading

From Field Notes.

§ QUESTIONS
FAQ

Questions people actually ask.

Can you really see what a PDF said before it was edited?

Sometimes, yes. PDFs are commonly saved by appending changes rather than rewriting the file, so the previous version's objects are often still physically present inside it. When that happens the earlier text can be reconstructed and shown next to the current value. When the file was fully rewritten, it cannot — and the tool says so rather than guessing.

Does a PDF with multiple revisions mean it was tampered with?

No. Revisions are completely normal: signing a document adds one, filling a form adds one, annotating adds one. What matters is what changed and whether the change is consistent with the document's story. A one-revision file claiming years of amendments, or a signed contract with content added after the signature's coverage ends, are the shapes worth looking at.

What is hidden text in a PDF?

Text that is present in the file but not visible when you read it — white on white, clipped outside the page, rendered in an invisible mode, or covered by a shape drawn on top. It has innocent causes, especially the invisible text layer scanners add so a scan is searchable. It also has an obvious dishonest use, which is why it is worth seeing.

Is this the same as looking at PDF metadata?

No, and the difference matters. Metadata is what the file claims about itself, and it is trivially editable. This tool reads structure — the cross-reference tables, object generations, and appended revisions that the format itself creates. Structure is much harder to falsify because it is a side-effect of how the file was written, not a field anybody typed.

Why does the analysis sometimes say a check was limited?

Because coverage is reported honestly. Encrypted files, unusual object structures and very large documents can put a check out of reach within the bounded time the free tool allows. Missing coverage is reported as missing — it never quietly becomes a clean result.

Do you keep the PDF I upload?

No. The file is analyzed in an isolated worker and discarded when the response is sent. It is never stored, never archived, and never used for anything else.

Structure is one layer of five.

A free account runs the full forensic scan — metadata, content, images and cross-document intelligence — and keeps the report.