Skip to main content
VellumPDF

Pre-send check

What your PDF reveals without your knowing, in one report — nothing is changed or uploaded.

Your files never leave your device

Drop your PDF here

Nothing is changed: this report only reads the document.

How to check a PDF before sending it, step by step

The check reads the PDF without changing it and tells you, in one report, what it gives away beyond the visible text: faulty redaction, earlier versions, metadata, links with trackers, AI leftovers, scripts, attachments.

  1. Drop the PDF to check

    Drag the file in or click to choose it. The check starts at once, entirely in your browser; a long document takes a few seconds.

  2. Read the summary, then the issues to fix

    At the top, the number of issues to fix before sending. The issues follow, from most to least serious: each carries a severity, from “High” to “OK”.

  3. Follow the “Fix with” links

    Each issue that has a solution points to the right VellumPDF tool: redact for real, erase the metadata, repair the file to remove its earlier versions, sanitize scripts, flatten a form.

  4. Keep a record of the check

    The “Download the report (PDF)” button saves the report, with the SHA-256 fingerprint of the checked file. Check the corrected document again before sending it.

On an encrypted PDF, the analysis stops at that finding: structure, text and scripts stay unreadable until the file is unlocked.

Frequently asked questions

Does this tool change my PDF?

No, never. The check reads the file without saving it again. The only file you can download is the report itself, with the “Download the report (PDF)” button: a separate document that leaves yours untouched. To fix an issue, the tool points to the right VellumPDF tool (redact, metadata, sanitize, flatten, repair, protect).

What does “hidden text” mean in the report?

Two distinct signals, both hard to spot with the naked eye: text drawn in an invisible render mode (common on the OCR layer of a scan), and text positioned outside the page’s visible area — a classic sign of a botched redaction that moved text instead of destroying it.

Why is an unencrypted document flagged?

It’s not an error in the file: it’s a reminder that anyone can open a PDF with no password. The report notes it for information, with a direct link to the protection tool if you want to fix that.

Can the report analyze a PDF that’s already password-protected?

Only up to a point: encryption technically prevents reading metadata, text and scripts. The report then flags that the document is encrypted and suggests unlocking it first.

What does “optional layer” mean?

A PDF can contain several content layers that can be shown or hidden independently (OCGs) — common in architecture or cartography, but also a way to conceal content that’s still technically present in the file even when it isn’t displayed.

What is an earlier version in a PDF?

Many programs save a change by appending it to the end of the file, without erasing the previous state: this is an incremental save. The PDF then holds several complete versions, and anyone can reopen the old one. The check counts them and lists the text they held that no longer appears in the current version — for instance an amount that was redacted and then simply saved. The “Repair a PDF” tool rewrites the whole file and removes those versions. Exception: in a digitally signed document, each signature adds a version, which is normal, and rewriting the file would invalidate the signature.

How does the tool spot a faulty redaction?

It looks for black areas on a page, drawn boxes or annotations, and checks on the rendered page that they are truly opaque, so that a dark title band is not mistaken for a hiding place. It then looks for text still sitting underneath. If there is some, that text can be copied and searched despite the box: it must be properly redacted with the “Redact PDF” tool. The check covers the first 40 pages.

What is a link with a tracker?

A link that tells a third party when the recipient clicks: campaign parameters (utm_source and its siblings), ad-network click IDs (Meta’s fbclid, Google’s gclid, Microsoft’s msclkid…), or a link rewritten by an e-mail filter such as Microsoft Defender (Safe Links), which names your organisation’s filter and often holds an e-mail address. The check relies on a closed list of documented trackers: it guesses nothing. Addresses written out in the text are read too.

Does the tool say whether a text was written by AI?

No. No score claiming that a text was written by AI is computed: such detectors are wrong too often, especially on texts by people writing in a language they learned. The check only flags the technical leftovers that copying from an assistant leaves in the text (Markdown headings, source chips, interface header) and the opening or closing phrases typical of an assistant, worth rereading. To remove them, fix the original document, where the “Clean AI text” tool helps, then export the PDF again.

What does the PDF report contain?

The name, size and page count of the checked file, its SHA-256 fingerprint, which lets you show later that the report describes that very file, the date of the check, then each issue with its severity and the tool that fixes it. It gives counts and never reproduces text found under a redaction or text that was removed: a report you pass on must not become the leak itself. It is not an electronic signature.