Share-Safe File Check – Remove hidden metadata, comments and secrets before you share a file

A document that looks clean can still carry the author’s name, the folder it was saved in, deleted text kept as tracked changes, a hidden spreadsheet tab, reviewer comments, the GPS position of a photo or an API key somebody pasted into a note. Share-Safe File Check is a privacy check that runs entirely in your browser: it inspects photos, PDFs, Word, Excel and PowerPoint files, audio, video, archives and text files, tells you what a recipient could find, cleans the formats it can clean safely, and re-checks the cleaned copy.

What it looks for

• Photos (JPEG, PNG, WebP, GIF, TIFF, HEIC): GPS location, camera make and model, serial numbers, owner and artist names, capture dates, embedded thumbnails, XMP and IPTC fields, and data hidden after the end of the image.
• PDF files: author, creator and dates, XMP metadata, JavaScript and launch actions, attachments, comments and markup, hidden layers, filled form fields, cropped pages, unapplied redactions, earlier revisions and deleted objects still in the file, plus a scan of the page text for secrets and personal data.
• Word documents: author and last-modified-by, tracked changes, comments, hidden text, document variables, mail-merge sources and macros.
• Excel workbooks: hidden and very hidden sheets, hidden rows and columns, links to other workbooks, data connections, pivot caches, comments and the full path of the original file.
• PowerPoint decks: speaker notes, hidden slides, comments, embedded objects, thumbnails and linked files.
• Archives, audio and video: .git folders, .env and key files, system leftovers such as .DS_Store, file timestamps, ID3 tags, WAV and MP4 metadata including location.
• Any text: API keys, tokens, private keys, passwords in links, payment card numbers, IBANs, email addresses, phone numbers, local file paths, internal hostnames and invisible or direction-control characters.

Common jobs

Remove location from photos before posting them

Drop the photos in, look for the Location finding, and clean them. You get new copies with the GPS, device and owner details removed, and a second scan confirms what is left.

Send a PDF to a client without leaking its history

Choose External, clean the PDF, and download the copy. Author fields, XMP data, scripts, attachments and earlier saved versions are gone, and the report shows what was removed and what still needs your decision.

Share a Word or Excel file without tracked changes, comments or hidden sheets

The External preset accepts tracked changes, removes comments and speaker notes, and removes hidden sheets and slides when no formula, chart or link still depends on them. Anything it leaves in place is listed with the reason.

Check a folder or ZIP before uploading it

Drop the whole folder. Every file is checked, the summary panel shows what the recipient would receive, and cleaned copies download as one ZIP with the same folder structure.

Find passwords and API keys before they leave your team

Text, code, configuration files and the text inside documents and PDFs are scanned for credentials. Treat anything found as exposed and rotate it.

How it works

1. Add files or a folder. Nothing is uploaded.
2. Choose the audience: internal team, external client or public. This sets how serious each finding is and offers a preset of cleaning options.
3. Read the verdict, score and findings for each file, with why it matters and what to do.
4. Clean the files you can, review anything left, and download the cleaned copies or a report in text, CSV or JSON.

Privacy

Files stay in your browser. Reports mask names, coordinates and contact details unless you turn that off. Files are remembered between visits only if you switch on “Remember files”, and “Delete saved files” removes them. The only download is the PDF library, fetched once from a public CDN when you use a PDF.

What it cannot do

It cannot prove a file is free of hidden data: cleaning is re-checked with the same scanner. It does not read text inside images (no OCR), cannot clean legacy .doc, .xls and .ppt files, HEIC or camera RAW images, and does not inspect Ogg or FLAC tags. Trimming a cropped PDF page hides the margin but does not erase what was drawn there. For high-stakes files, also review them by eye.

Frequently asked questions

What is hidden data in a file?

Information stored in a file that you do not see when you open it: the author’s name, the computer and software used, GPS coordinates in a photo, tracked changes and comments in a Word document, hidden sheets in a spreadsheet, speaker notes in a presentation, scripts and attachments inside a PDF, or a password pasted somewhere in the text.

Are my files uploaded anywhere?

No. Files are read and cleaned inside your browser. The only network request is a one-time download of the pdf-lib library (from the jsDelivr CDN) the first time you check or clean a PDF. Nothing from your files is sent to a server.

How do I remove location data from a photo?

Add the photo, open its result to see the GPS finding, then choose Clean this file. For JPEG, PNG, WebP and GIF the tool writes a new copy without EXIF, GPS, XMP and IPTC data and re-checks it. You can keep the orientation tag so the picture does not turn sideways. HEIC, TIFF and camera RAW files are checked but cannot be cleaned here.

How do I remove metadata from a PDF?

Add the PDF and choose Clean. The tool drops the author, creator, dates, title, XMP metadata and application data, and by default also removes scripts, launch actions and attached files. It rewrites only the current version of the file, which discards earlier revisions kept by incremental saves. Optional settings clear or flatten form fields, trim cropped pages, or rebuild the PDF from its pages.

Can it remove tracked changes and comments from Word, Excel and PowerPoint files?

Yes for .docx, .xlsx and .pptx (and OpenDocument .odt, .ods, .odp). Comments and speaker notes are removed with “Remove comments, markup and speaker notes”. Tracked changes are accepted with “Accept tracked changes”, which permanently deletes the deleted text. Hidden sheets and hidden slides are reported, and can be removed with a separate option when nothing else depends on them.

Does it find passwords, API keys and personal data?

It scans text files, document text and PDF page text for cloud and API keys (AWS, GitHub, Stripe, Slack, Google and similar), private key blocks, passwords in URLs, bearer tokens, payment card numbers that pass the Luhn check, IBANs, US Social Security number formats, email addresses and phone numbers. Values are masked in the results and reports.

What do the Internal, External and Public settings mean?

They describe who will receive the file. They change how serious each finding is, and each one applies a preset of cleaning options that you can still change. Internal keeps comments and hidden content. External also removes comments, accepts tracked changes, removes hidden sheets and slides and trims cropped PDF pages. Public does the same and flattens PDF forms.

Can I check a whole folder or a ZIP file?

Yes. Drop a folder or use Add folder (up to 1,000 files). Files are checked two at a time and you can cancel the rest. ZIP files are opened and the files inside are checked and cleaned too; cleaned copies can be downloaded as one ZIP that keeps your folder layout.

What does “Safe to share” actually mean?

It means this scanner found nothing it knows how to find. It is not a guarantee. Image-only PDF pages (no OCR), fonts without a text map, encrypted or very large files, and unsupported formats are reported as not fully checked and are never labelled fully safe.

Which file types can be checked, and which can be cleaned?

Checked: JPEG, PNG, WebP, GIF, TIFF/RAW, HEIC/AVIF, PDF, Word, Excel, PowerPoint, OpenDocument, ZIP, MP3, WAV, MP4/MOV/M4A and text or code files. Cleaned: JPEG, PNG, WebP, GIF, MP3, WAV, MP4/MOV, PDF, Office, OpenDocument and ZIP. Legacy .doc, .xls and .ppt files, Ogg and FLAC are flagged but not cleaned.

Does cleaning change my original file?

No. Cleaning always makes a new copy and re-scans it; your original is never modified. Digitally signed PDFs lose their signature when cleaned, because the file changes.

Does it work offline, and which browsers does it need?

After the page has loaded, everything except the first PDF check works offline. A current browser is needed for ZIP-based formats (Office, OpenDocument, ZIP) because they use the built-in compression streams found in browsers released in 2023 or later.