Zellio.io

Document Privacy Inspector

See what a PDF or Office file says about you, then strip it.

Runs locallyWorks offlineShare link carries settings, never your data
Send output toImage RedactorEXIF Viewer & RemoverPDF ToolkitBuild a workflow from thisOutput stays on this page until you send it.

Frequently asked questions

Is my document uploaded anywhere?

No. Everything runs locally in your browser using standard web APIs — your text, files and inputs are never uploaded to a server, so the tool works even offline once the page has loaded.

Why can a cropped picture be recovered?

Because cropping in Office is a display instruction rather than an edit. The document stores the whole picture plus a rectangle describing which part of it to show, so dragging the crop handles back out restores everything that was cut off. Screenshots cropped to hide a figure, a name or a neighbouring window have been published this way many times. The fix is to crop in an image editor before inserting, or to cover the area with the Image Redactor, which rewrites the pixels.

What does "Not removed" mean next to a finding?

That the item is part of the document's content rather than its properties, and removing it here would mean rewriting the body — which risks producing a file that no longer opens. Comments, tracked changes, cropped pictures, hidden worksheets and embedded images are all in this group. Deal with them in the application that made the file: accept or reject the tracked changes, delete the comments, unhide and delete the sheets. The clean copy handles the properties, and the second scan shows you exactly what it did not touch.

Does saving a clean copy change the document itself?

For Word, Excel and PowerPoint, no. Only the two property files are rewritten; every other part of the archive is copied across byte for byte, and the ZIP's own per-file timestamps are reset. A PDF is different: it is written out fresh from the objects still in use, which is what discards the earlier revisions left behind by previous saves. The pages and their content are unchanged, but the file is not byte-identical to the original.

Which files can it read?

PDF, and the modern Office formats — .docx, .xlsx and .pptx. The older binary .doc, .xls and .ppt files use a completely different container and are not supported. Photos and screenshots are a different job, handled by the EXIF Viewer & Remover. A password-protected PDF is reported as encrypted and cannot be cleaned without the password.

Is it free?

Completely. There is no sign-up, no account, no watermark and no usage limit. The tool is supported by unobtrusive ads, not by selling or processing your data.

Pro tips

  • Check a CV or a bid document before you send it. The author name, the company field and the total editing time all come from the machine it was written on, and the title property is often the filename of whatever you copied it from.
  • Treat the total editing time as public. It is a plain count of minutes the file was open, and on submitted work it is the number people least expect to be readable.
  • On a PDF that has been through several rounds, look at the revision count first. Each save appended rather than replaced, so text that was deleted in a later draft can still be sitting in the file.
  • Run the clean copy back through the inspector — the tool does it automatically after saving. Anything still listed is content, not metadata, and needs handling in Word or Acrobat.

About Document Privacy Inspector

Cropping a picture in Word hides part of it rather than removing it, and every incremental save leaves the previous version of a PDF inside the file. Both survive a rename, an email and a forward, so the only way to know what you are sending is to open the container and look.

A Word, Excel or PowerPoint document is a ZIP archive of XML parts, and a PDF is a stack of objects appended to over time. Neither format was designed to forget. Alongside the text and pictures somebody meant to send, both carry the account name that produced them, the software and its version number, a timestamp on every component, and — depending on how the document came together — comments, deleted text, hidden worksheets, and links to folders on the author's own machine.

This opens the container and lists what is in there, item by item, with a note on what each one actually gives away. Saving a clean copy rewrites the property parts and copies everything else across untouched, then runs the same scan over the result and prints whatever is left. That last step matters: the findings that carry the most, tracked changes and cropped pictures among them, cannot be taken out without editing the document itself, and a tool that quietly implied otherwise would be worse than no tool.

The findings a clean copy cannot remove each have a fix inside the authoring application, and they are worth knowing because the report will keep listing them until you apply one. Tracked changes have to be accepted or rejected rather than merely hidden from view, since hiding them only changes the display setting. Comments have to be deleted rather than resolved. A cropped picture stays whole until you compress the pictures in the document with the option to delete cropped areas enabled, which is the only action that actually discards them. Hidden rows, columns and worksheets have to be unhidden and removed. For a PDF carrying earlier revisions, saving it as a new file rather than appending another incremental save is what collapses the history.

Common use cases

  • Checking a CV or covering letter before applying, where the author name and template path give away where it was copied from.
  • Reviewing a document before it goes to a client, a court or a journalist, when the company field or a comment thread would be awkward.
  • Confirming that a redacted PDF really lost the redacted text rather than keeping it in an earlier revision.
  • Auditing a deck for cropped screenshots before it is published or shared outside the company.
How it comparesDesktop exiftool reads far more formats but is a command line and does not explain what it found. Online metadata removers upload the document to a server, which is a strange trade for a privacy task, and most simply strip the properties without ever telling you what was in them. The difference here is that the findings are the output: each one is named, explained, and marked according to whether the clean copy can actually remove it.