Why this matters
Some PDF tracking services (DocSend, Adobe Analytics, etc.) embed JavaScript that pings their server when the PDF is opened — revealing your IP address and viewing time.
PDF metadata can contain unique document identifiers that allow the originating service to track the PDF as it's shared across people.
Embedded web beacons (1×1 transparent images) can leak your IP address and viewing time to a third-party server when the PDF is opened.
For sensitive documents (whistleblowing, anonymous tips, confidential business documents), tracking details can de-anonymize the viewer.
What the scanner detects
- Embedded JavaScript and ActionScript that executes on file open
- External URL references (potential web beacons)
- Unique document identifiers in XMP metadata
- Author/Creator/Producer metadata that can fingerprint the source
- Embedded file attachments (which can contain tracking scripts)
Ready to scan your PDF?
Drop your file into the scanner. Results in 5 seconds. Nothing leaves your browser.
Open the scannerHow it works
Click "Scan your PDF now" above. The scanner opens in your browser tab — no download, no install.
Drop in your PDF. The file is parsed entirely in your browser using JavaScript. No upload, no server, no logs.
Review your 0–100 risk score, the list of findings, and the AI-generated redaction recommendations. Then take action.
Frequently asked questions
How do I scrub tracking details out of a PDF?
Drop your PDF into the scanner above. It checks for embedded JavaScript, external URL references, XMP tracking identifiers, and identifying metadata. To scrub: remove the JavaScript, strip the XMP block, and clear the info dictionary using the redact and metadata-removal tools.
Can PDFs really track when I open them?
Yes. PDFs can contain JavaScript that executes when the file is opened, which can ping a server with your IP address and viewing time. This is how some document-tracking services (DocSend, Adobe Analytics) work. Most PDF viewers disable JavaScript by default for security, but not all.
What are PDF web beacons?
Like email tracking pixels, PDF web beacons are 1×1 transparent images hosted on a third-party server. When the PDF is opened and the image loads, the server logs the viewer's IP address, viewing time, and user agent. They're rare but used by some document-tracking services.
Is it safe to open a PDF I received from a stranger?
Risky. PDFs can carry JavaScript, embedded files, and external URL references that can leak your IP or compromise your viewer. Best practice: open PDFs from untrusted sources in a sandboxed viewer (most browser-based PDF viewers are sandboxed by default). To check what a PDF contains before opening, scan it with a tool like PrivacyScanPDF.
Related privacy scans
How to Delete the Electronic Footprint From a PDF
Every PDF carries an electronic footprint: who made it, what software they used, when, and sometimes where. This footprint persists across saves, copies, and email forwards. To delete it, you need to strip the PDF's info dictionary and XMP metadata block — not just the visible content. This tool does that locally in your browser.
Remove Hidden Identifying Background Data From a PDF
PDFs have multiple layers of 'background' data that don't show on screen but can identify you: the XMP XML metadata block, embedded JavaScript, file attachments, annotations, and custom enterprise metadata. This tool scans all of them locally and shows you what's hiding in your PDF.
How to Unattach the Original Owner Name From a PDF
When you create a PDF, your editing software auto-attaches your name as the 'Author' in the file's metadata. This attachment persists through saves, copies, and forwards — the original owner stays attached. To unattach it, you need to strip the Author field (and ideally the full info dictionary) from the PDF's bytes. This tool does that locally.
Sanitize a PDF Before Uploading to a Public Server
Before uploading a PDF to a public server (court filing system, grant portal, government website, public records repository), you should sanitize it: remove all metadata, embedded JavaScript, file attachments, and any PII in the visible text. This tool scans your PDF locally and shows you exactly what needs to be sanitized before upload.
Your PDF never leaves your device
Every operation runs as JavaScript in your browser tab. No upload endpoint exists. Verify it yourself in DevTools (F12 → Network).