Inspect Security & Permissions - Free Online Browser Tool
Report what is actually inside a PDF: encryption, embedded files, scripts, annotations and form fields.
Before deciding whether a document is safe to work with, it helps to know what protections it already carries and what it is carrying underneath them. This tool reads the document structure and writes a plain-text report. Nothing is changed.
This inspect security & permissions utility runs completely inside your web browser. Your document is opened locally and processed on your own device using JavaScript and WebAssembly, so your file is never uploaded to any server. There is no signup, no watermark and no limit on how many documents you can handle.
- 100% client-side - files never leave your device
- Instant processing, no upload wait
- Works on desktop, tablet and mobile
- Free forever, no account required
Common next steps: Unlock / Decrypt PDF, PDF Version Inspector, Redaction Leak Detector.
How to Use the Inspect Security & Permissions Tool
Four steps, and the whole thing runs locally on your own device.
-
Load the PDF
Drop in the document. It is opened read-only, without unlocking or modifying anything.
-
Read the encryption line
The report states plainly whether the file is encrypted. If it is not, it says so, because that is the single most important fact.
-
Check what is hidden inside
Embedded files are listed by name, and script actions, remote-file actions, annotation counts and form field counts are reported.
-
Act on it
Run Strip Embedded Files to remove payloads, Unlock PDF to clear restrictions, or <a href="https://www.allpdf.tech/legal-pdf-tools/bulk-keyword-redaction" class="seo-link">Bulk Keyword Redaction</a> to hide sensitive text.
Frequently Asked Questions
What is the difference between permissions and encryption?
Encryption is genuine cryptography and needs a password to open. Permissions are flags a compliant reader respects, and without an owner password they can be cleared in a couple of clicks.
Why does the encryption algorithm matter?
Older algorithms are far weaker than modern ones. AES-256 is appropriate for anything sensitive; legacy 40-bit encryption is effectively no protection at all.
Does the report judge whether the file is malicious?
No, and it does not pretend to. It reports the payload carriers that are present so you can see them, then Strip Embedded Files removes them.
Does opening the document here compromise it?
No. Inspection is read-only and happens locally, so the file is not modified and nothing is disclosed to a server.
Why does an encrypted file say permissions are unreadable?
Because the permission flags live inside the encrypted part of the file, so they cannot be read without the password. Unlock the file first, then inspect the result.