Drop a document or image here, or
Max 10 MB · processed in memory, never stored
No PDF handy? Try a sample:
Three fictional utility statements, precomputed, no upload, no quota.
Have the original? Compare the two directly. The strongest check there is.
- Drop a file. PDF, Word, Excel, PowerPoint or an image.
- Read the signals. Each one shows the raw evidence behind it.
- Automate via API. One POST returns the same JSON report.
See it as an API call
curl -s https://tamperlens.com/api/v1/inspect -F [email protected]{
"summary": { "riskScore": 95, "riskBand": "high", "signalCount": 2 },
"signals": [
{ "id": "incremental-updates", "severity": "high", "title": "…", "evidence": {…} }
]
}
No key, no account. Quickstart,
full reference, or tamperlens-mcp
so an agent can screen a file before it ingests one.
Nineteen families for PDFs and nine more for images. See what each one measures, read how often they fire on genuine documents, or see what defeats them: a two-step launder takes a forged document from 70 to 10.
Redaction by paint order: a drawn box with no annotation still hides nothing.
Document-borne prompt injection: text written for the model that reads the file, not for you.
What Tamperlens is not
- Not a ruling. Signals with the evidence behind each; the call stays yours.
- Not a vault. Files are parsed in memory and gone when the response returns.
- Not a renderer. The engine opens and executes nothing it reads.
- Not a signature validator. Present is not the same as valid; that check lives elsewhere.
Common questions
Can you really tell if a PDF was edited?
Often, yes. A PDF records more history than it shows on screen:
incremental-update revisions appended after the original save, Info
dictionary dates that disagree with the XMP metadata, changed
/ID pairs, editor fingerprints in the Producer field, and
digital signatures that no longer cover the whole file. Scanners,
print-to-PDF drivers and e-signature platforms leave those traces too,
so each finding is reported with the raw evidence behind it and the
judgment stays with you: the
field guide walks through all nineteen
signal families.
Is my document uploaded or stored anywhere?
The file is sent over HTTPS, parsed in memory and never written to disk. The privacy policy spells this out.
Can I automate checks from my own code?
Yes. One HTTP POST returns the same report as JSON. The quickstart gets you to a first call; the reference has the rest.
