Drop in a document and a dashboard resolves: who made it, what travels with it, and what is in the file that is not on the page. It runs entirely in your browser. The document never leaves this tab; there is no server here to send it to.
cooking · work in progressGreen — nothing beyond what is on the page Amber — something travels with the file you may not have meant to send Red — something is in the file that is not visible on the page Grey — could not be checked
Site X-ray points a grid of glanceable tiles at a website. This points the same grid at a document. A PDF is a container, and the page you see is one thing in it: alongside it ride the author's name, the software that made it, every earlier save, comments, attachments, links, and, often enough to matter, text that was covered up rather than taken out.
The page is drawn exactly as a viewer would draw it. Then every piece of text the file contains is checked against the pixels where it landed. Solid ink where words should be means they were covered; no ink at all means they were drawn invisibly, white on white or too small to see. Either way the words are in the file and any search will find them. The check cannot see intent, only whether you could see the words.
Every tile reports a count, a name or a date read from the file. Nothing summarises the document and nothing decides whether its contents are sensitive; that is a judgement about your document and only you can make it. A red tile says "this is in the file and not on the page", nothing more.
A scan is a picture. Nothing here reads pictures, which is exactly why a search will not find a name in one, and why a redaction done by searching misses everything a scanner produced. Text drawn as outlines rather than letters is invisible to it for the same reason. Encrypted files cannot be opened without their password and come back grey.
Reading is done by pdf.js 6.3, the same engine Firefox uses, served from this site. Large files take a while: the covered-text check draws every page, and stops after forty. Nothing is uploaded, stored, or sent anywhere.