Somebody sent you a contract, a photo, a spreadsheet. Drop it here and find out who really wrote it, on what machine, how long they actually spent on it, what got deleted along the way, where the photograph was taken, and whether the file reaches out to a server the moment you open it. The file is read inside this browser tab and is never uploaded.
Drop in a file somebody sent you.
Who really wrote it. A Word or Excel file is a zip archive, and inside it are the original author's account name, whoever saved it last, the revision count, and the total minutes the document has ever been open for editing. When a vendor calls something their standard non-negotiable template, the edit clock is often the most interesting number in the room.
What was taken out. Text deleted under tracked changes does not leave the file, it just stops being displayed. Neither do comments, nor hidden spreadsheet tabs. X-RAY pulls them back out and shows you what the document said before somebody edited it.
Redactions that did not work. A black rectangle drawn over a PDF is a drawing; the words underneath are still in the file and still selectable. X-RAY compares what the PDF says is on each page against what is actually visible once the page is rendered, and text that exists but cannot be seen is text somebody believed they had removed.
Where a photograph was taken. Exact coordinates, timestamp, camera make and model, and the body and lens serial numbers, which quietly connect every photo ever taken on that camera. If editing software wrote to the file, that shows up too.
Marks meant to trace you. Invisible zero-width characters can be woven through a document so that each recipient gets a subtly different copy, and a leak can be traced back to whoever received it. X-RAY counts them and tells you the pattern. We also sell the tool that puts them there: it is called CANARY, it is on this site, and you should know that both directions exist.
Files that phone home. A document can reference a remote image, an external template, or carry an embedded script. Opening it then tells that server your IP address and the moment you opened it, which is a read receipt you never agreed to. But an indicator is not a verdict. Ordinary corporate documents do all of these things routinely. X-RAY tells you what is there and leaves the conclusion to you, because software cannot read a sender's intent and should not pretend to.
The one false positive worth knowing about. A scanned document with OCR carries an invisible text layer by design, and every word of it is technically hidden. When almost all of a page's text is invisible, X-RAY says so rather than announcing a redaction that is not there. When only a few isolated passages are hidden on an otherwise normal page, that is the real thing.
Nothing is uploaded, and that matters more here. A tool for inspecting a document you were not meant to inspect is the last thing that should be posting that document to a server. The unzipping, parsing and rendering all happen in this tab, on your machine.