Local-only document inspection

See what the recipient may recover before you send the file.

Scan PDFs and PowerPoint files for speaker notes, hidden slides, comments, embedded files, false redactions, author metadata, cropped image data, active content, and other material the normal document view can miss.

No upload No account Open source

Inspect a file

Drop it here. It stays here.

Browser-local

Choose files or drop them here

PDF and PowerPoint · up to 200 MB per file · multiple files supported

A completed scan is evidence, not a guarantee. Unsupported encryption, uncommon encodings, malformed files, and new application behavior can limit coverage.

What it catches

A clean-looking file can still carry the working copy.

Safe to Send inspects the file package and content streams, not merely what a viewer renders on screen. Findings include the exact location, evidence, confidence, and a practical fix.

Read the inspection methodology
01

PowerPoint

Speaker notes, hidden slides and objects, off-slide text, comments, custom XML, embedded files, macros, external paths, cropped-image remnants, and image metadata.

02

PDF

Text beneath opaque rectangles, invisible or off-page text, annotations, form values, attachments, JavaScript and actions, optional layers, metadata, and incremental revisions.

03

Sensitive values

Credential-like strings, private keys, tokens, internal URLs, email addresses, IBANs, payment-card patterns, and other values found specifically inside concealed content.

04

Coverage failures

Encrypted entries, unsupported filters, malformed archives, size limits, extension mismatches, and other conditions that make a reassuring result unsafe to trust.

How it works

Deterministic checks. Inspectable rules.

No file is uploaded and no remote model sees its contents. The same scanner core powers the browser, command line, tests, and CI output.

  1. 1

    Open locally

    The browser reads the selected bytes into a dedicated worker. The page’s security policy blocks network connections.

  2. 2

    Inspect structure

    ZIP entries, XML parts, PDF objects, and decoded streams are checked with bounded memory and decompression limits.

  3. 3

    Report evidence

    Every finding carries a stable rule ID, severity, confidence, location, evidence excerpt, and remediation.

  4. 4

    Export or automate

    Download JSON, Markdown, or HTML reports, or run the same checks in scripts and GitHub Actions through the CLI.

Command line

Put the check in the delivery path.

Scan release folders, fail builds on high-risk findings, and export SARIF for code-scanning systems.

$ npx safe-to-send proposal.pptx

DO NOT SEND YET
2 high · 4 medium · 1 low

High
- Speaker notes remain in slide 8
- Embedded workbook found in slide 11

Questions

What the result does—and does not—mean

Does my file leave this device?

No. Scanning runs in a browser worker. The page contains no analytics, advertising, remote fonts, remote scripts, or upload endpoint. Its content security policy disables network connections while the page is open.

Does “No obvious hidden content found” mean the file is safe?

No. It means the enabled checks completed without finding a known indicator. File formats are complex, applications change, and some encrypted or uncommon structures cannot be inspected. Review the coverage section and use the source application’s own inspection tools as well.

Why can a black rectangle fail to redact a PDF?

A visual overlay can cover text without deleting the text object underneath. Safe to Send decodes supported content streams, estimates text and rectangle geometry, and warns when recoverable text appears covered rather than removed.

Why does cropping an image in PowerPoint matter?

Cropping can change only the displayed region while retaining the source image inside the presentation package. A recipient may be able to extract the original. Replace it with a permanently cropped copy or use PowerPoint’s option to delete cropped areas.

Can I use it in CI?

Yes. The CLI returns documented exit codes and exports text, JSON, Markdown, HTML, and SARIF. It can scan individual files or supported files in directories.

Before the attachment leaves

Inspect the delivered file, not the one you remember editing.