👻
Text you cannot easily see
Invisible characters, hidden Word runs, white or tiny text, off-page PDF text, and hidden HTML can survive extraction even when they are difficult or impossible to notice in a normal reading view.
Find hidden or suspicious content inside a document.
Upload a PDF, Word document, HTML file, or plain-text document and see what a normal reading view might miss — including hidden text, suspicious instructions aimed at AI, invisible characters, possible secrets, comments, metadata, macros, and other stored content.
🔒 Document contents are analyzed locally in your browser — not uploaded to the ScrubMyText API.
Drop a document here to inspect what is really inside it
We look for content that may be invisible or easy for a person to miss but still readable by software or AI. PDF · DOCX/DOCM · HTML · TXT · Markdown · CSV · JSON · XML · up to 25 MB
Choose a document to scan.
What can be hiding inside a document?
A document is more than the words you see on the page. PDF, Word, and HTML files can contain text layers, comments, annotations, metadata, deleted revisions, alternative text, invisible Unicode, off-page elements, scripts, and other machine-readable content. Most of it is harmless. The problem is that an AI system may receive some of that content even when the person uploading the file never noticed it.
🤖
Instructions written for an AI
A document can contain language such as “ignore previous instructions,” requests to reveal hidden prompts, or directions to run tools. ScrubMyText flags patterns like these for human review rather than declaring them malicious.
🔐
Secrets and extra document data
Credentials, comments, metadata, deleted text, macros, annotations, embedded files, and encoded content can all exist outside the obvious body text. The scanner surfaces supported signals so you can decide whether they belong there.
The report is designed for normal people, not security engineers
Technical scanners often report every detector hit separately, which can make one suspicious sentence look like several different problems. ScrubMyText combines related checks on the same underlying content into one item, then translates that item into three practical questions. The 0–100 number is a review-priority score, not a probability that a document is malicious. Combinations such as hidden text plus AI-directed override language are intentionally scored much more strongly than the same words appearing visibly in an ordinary article:
1
What did we find?
One plain-English finding for each distinct piece of content. If the same hidden sentence triggers several checks, those signals are grouped together instead of being counted repeatedly.
2
Where is it?
PDF findings include the page and approximate page area when the text layer provides coordinates. Word findings identify the body paragraph, nearby heading, table/row/cell, header, footer, comment, footnote, or other section when available.
3
Why could it matter?
A short explanation of how software or AI might interpret the content differently from a person looking at the visible page.
What we found
Items to review
Every finding below tells you what was detected, where it appears, and why it could matter.
Extracted text preview
Useful for checking what an AI/text extractor may actually receive. Preview is capped at 20,000 characters.
What the scanner checks
👻
Hidden & invisible text
Text that may be hard or impossible to notice normally: invisible characters, Word text marked hidden, white or tiny text, off-page PDF text, hidden HTML, and hidden annotations.
🛡️
Prompt-injection signals
Language that appears to address an AI directly — for example, telling it to ignore other instructions, reveal hidden prompts, use tools, change roles, or send secrets. These are review signals, not a maliciousness verdict.
🔐
Possible secrets
Text that looks like common API keys, access tokens, private keys, passwords, or other credentials. Secret-shaped values are masked in the report.
🧩
Document structure
Information stored outside the obvious body text, including Word comments, deleted revisions, extra XML, PDF annotations or attachments, HTML comments, links, and metadata.
⚡
Active content
Word macros, PDF JavaScript actions, and HTML script blocks are called out so you know active content exists. ScrubMyText never executes it.
🔎
Encoded / obfuscated content
Encoded-looking text, mixed alphabets that can create look-alike characters, and unusual control characters that may make content harder to review.
What does a suspicious finding mean?
Suspicious does not mean malicious. A cybersecurity article may legitimately contain phrases that look like prompt injection. A design document may intentionally use white text. A PDF may include annotations that are part of a normal review process. ScrubMyText is meant to show you the less-obvious parts of the file so a person can make the final judgment.
The scanner is especially useful before sending an unfamiliar document into ChatGPT, Claude, Gemini, a retrieval system, or an AI agent that can take actions. If a finding is unexpected, review the original file and its source before relying on it in an automated workflow.
Frequently asked questions
Can hidden text in a document be read by an AI?
Potentially, yes. Many AI workflows extract text from the underlying document rather than looking only at the exact pixels a person sees. That can expose hidden runs, comments, annotations, metadata, text layers, and invisible characters depending on the extraction software.
Does a prompt-injection finding prove the document is dangerous?
No. Prompt-injection detection is heuristic because ordinary writing can contain instruction-like language. ScrubMyText flags patterns worth reviewing and shows the triggering text so you can judge the context yourself.
Why does Word show a paragraph or table location instead of a page number?
DOCX files do not reliably store fixed page numbers. Pagination can change with fonts, margins, printer settings, and the version of Word used to render the file. ScrubMyText therefore reports the structural location it can verify — such as body paragraph, nearby heading, table/row/cell, header, footer, comment, or footnote — rather than inventing a page number.
Does the scanner read text inside screenshots or scanned images?
Not currently. This version does not perform OCR, so text that exists only inside an image can be missed. A PDF with no extractable text layer will be flagged as a scanner limitation.
Is my document uploaded to ScrubMyText?
No. The document scanner analyzes the selected file in your browser and does not send the file contents to the ScrubMyText API. PDF parser code is loaded in the browser, but the selected PDF itself is not intentionally sent to that code provider.
Is this a malware or antivirus scanner?
No. ScrubMyText focuses on hidden, suspicious, and machine-readable document content. It can flag supported active-content signals such as Word macro packages, PDF JavaScript actions, and HTML scripts, but it is not a substitute for antivirus or endpoint-security software.
Why scan before using AI?
AI assistants and agent frameworks often consume extracted text rather than the exact visual page a person sees. That can expose text in comments, hidden runs, annotations, metadata, or invisible Unicode that is easy for a human reviewer to miss.
The scanner is designed to make that hidden machine-readable surface easier to review before you paste, upload, retrieve, or automate with a document.
Privacy-first browser processing
For the document scanner, parsing and analysis happen in your browser. The file itself is not sent to the ScrubMyText API. DOCX parsing uses a locally hosted open-source ZIP parser; PDF support loads the open-source PDF.js parser code in the browser.
You can close or refresh the page to clear the current in-memory scan.
If advertising is enabled on this page in the future, ad placements will be kept outside the upload controls and scan findings so the inspection report remains easy to read.
Paste extracted text instead
Already have the text? Use the dedicated untrusted-text scanner for structural and instruction-like signals.
Scan untrusted text →Inspect exact Unicode
Use the text inspector when you need exact positions for zero-width, bidi, control, and normalization anomalies.
Inspect text →Building an agent?
ScrubMyText also exposes deterministic text-integrity and agent-infrastructure operations through REST and MCP.
Agent tools →