What does your file say about you?

Every PDF, photo or Word file carries metadata you never typed, who wrote it, on what machine, where you were standing. Drop one and read it all.

Drop a document or image here, or

PDF, Word, Excel, PowerPoint, JPEG, PNG, WebP, HEIC · max 10 MB · processed in memory, never stored

No photo handy? See what an ordinary one carries:

A fictional snapshot taken in a public park. Nobody typed any of it, and it names the photographer, her phone, that phone's serial number, and the spot on Earth she was standing on. Download it and check the findings in any tool you like.

We read your file. We never change it. Tamperlens has no code path that writes a document. The bytes are parsed in memory, the answer is JSON, and nothing survives the response. There is deliberately no "download a cleaned copy" button here: producing a stripped file is a different product with different promises, and this one's promise is that your file goes home exactly as it arrived. How that is enforced.

What you will find in there

Metadata is written by the software, not by you, which is why it so often says more than intended. A payslip exported from a payroll system names the system. A contract saved by a paralegal names the paralegal. A photograph taken on a phone carries the make, the model, the lens, the exact second, and, unless the phone was told otherwise, the latitude and longitude.

The surprising one is Word and Excel. A .docx is a ZIP, and a photograph pasted into it keeps its own EXIF inside the package. Tamperlens opens those too: if there is a picture in your document with GPS in it, it is listed here with everything else.

Nobody types any of these. The software writes them, and a .docx carries a pasted photo's own EXIF inside the package.
A PDF /Info Author · Producer CreationDate · ModDate XMP packet xmp:CreateDate the tool that wrote it two records of one history A PHOTOGRAPH EXIF Make · Model · lens DateTimeOriginal BodySerialNumber GPSLatitude · GPSLongitude XMP · IPTC written by the camera, not by you A .DOCX: A ZIP FILE docProps/core.xml docProps/app.xml word/media/image1.jpeg with its own EXIF, intact GPS and all a file inside a file

Field names are the ones the formats themselves define. The report lists every key it finds, in every container, in the order the file stores them. These are the ones that come up most often.

Only want the fields that name a person?

This page is the whole report: every key, in every container, in the order the file stores them. If the question you arrived with is the narrower one, the privacy check runs the same parse and leads with the entries that identify somebody: names, machine paths, coordinates, device serials, the thumbnail of the frame before you cropped it. It also says what to do about each of them, which this page deliberately does not.

One parse, three readings, and only the third one draws a conclusion about the file.
your file, parsed once /metadata this page every key, every container, in the file's own order Reports. Concludes nothing. /privacy-check the narrower question the keys that name a person: names · paths · coordinates · serials · the pre-crop thumbnail …and what to do about each. / the free checker nineteen signal families over the same bytes Risk signals. Never a verdict. Same parse, same bytes, same 10 MB ceiling. The difference is which fields get led with.

All three run in memory and return JSON; none of them writes your file. This page and the privacy check are the same endpoint, POST /api/v1/metadata, presented two ways; the checker is POST /api/v1/inspect. See the reference.

This is not a fraud check

This page reports what the file says. It draws no conclusions and gives no risk score. If you want the forensic reading (whether a document was edited after signing, whether a redaction actually removed the text underneath, whether the dates contradict each other). That is the free checker, which runs nineteen signal families over the same file.

In the API

POST /api/v1/metadata returns the same report as JSON and costs one document from your monthly quota. It works without an API key, exactly like the checker. See the reference.