Drop a document or image here, or
Max 10 MB · without an account, your document is not kept
No PDF handy? Try a sample:
Three fictional utility statements, precomputed, no upload, no quota.
Have the original? Compare the two directly. The strongest check there is.
- Drop a file. PDF, Word, Excel, PowerPoint or an image.
- Read the signals. Each one shows the raw evidence behind it.
- Automate via API. One POST returns the same JSON report.
See it as an API call
curl -s https://tamperlens.com/api/v1/inspect -F [email protected]{
"summary": { "riskScore": 70, "riskBand": "high", "signalCount": 1 },
"signals": [
{ "id": "incremental-updates", "severity": "high", "title": "…", "evidence": {…} }
]
}
No key, no account. Quickstart,
full reference, or tamperlens-mcp
so an agent can screen a file before it ingests one.
Twenty families for PDFs and nine more for images. See what each one measures, read how often they fire on genuine documents, or see what defeats them: a two-step launder takes a forged document from 70 to 10.
Redaction by paint order: a drawn box with no annotation still hides nothing.
Document-borne prompt injection: text written for the model that reads the file, not for you.
What Tamperlens is not
- Not a ruling. Signals with the evidence behind each; the call stays yours.
- Not a vault. Keeping a file is your account's choice.
- Not a renderer. The engine opens and executes nothing it reads.
- Not a signature validator. Present is not the same as valid.
Common questions
Can you really tell if a PDF was edited?
Often, yes. A PDF records more history than it shows on screen:
incremental-update revisions appended after the original save, Info
dictionary dates that disagree with the XMP metadata, changed
/ID pairs, editor fingerprints in the Producer field, and
digital signatures that no longer cover the whole file. Scanners,
print-to-PDF drivers and e-signature platforms leave those traces too,
so each finding is reported with the raw evidence behind it and the
judgment stays with you: the
field guide walks through all twenty
signal families.
Is my document uploaded or stored anywhere?
Without an account, your document is not kept. An account keeps a short record with no text, and the file only if you opt in. Details in the privacy policy.
Can I automate checks from my own code?
Yes. One HTTP POST returns the same report as JSON. The quickstart gets you to a first call; the reference has the rest.
