The “private PDF tool” space is crowded, but the two operations people actually need to do safely — strip a file’s hidden metadata, and redact it so the underlying text is truly gone — were missing client-side. Every online option uploads your file to a server, asking you to trust a deletion policy you can’t verify.

And most “redaction” is a black rectangle drawn on top: the original text sits underneath, fully selectable and extractable — a well-documented way sensitive documents leak. We wanted a tool that removes the data for real, never uploads the file, and can prove both.

Everything in the browser — no upload endpoint exists

Metadata reading, scrubbing, redaction and verification all run locally in JavaScript and WebAssembly. There is no server that receives files. Even pdf.js’s worker, fonts and CMaps are bundled as local assets, so the heavy PDF path makes no third-party request either — the only network calls the app can make are licensing, which carry a key and never a file. You can confirm it in the network tab.

True redaction by flattening, not covering

For each marked PDF page we render it to a high-resolution raster, paint the redaction boxes onto the image, and rebuild the page from that flattened raster — so the underlying text and vector objects no longer exist in the file. Images are burned in at the pixel level. Pages you don’t mark are copied through untouched, so their text stays selectable.

Verification that re-parses the real bytes

The differentiator is the verify step. After scrubbing, we re-open the output and confirm each removed field is gone; after redaction, we re-extract the text that sat under the boxes and prove none of it survived, and that flattened pages yield zero extractable text. It checks the output, not the intention.

Lossless image stripping

For JPEG and PNG we rewrite the container — dropping the EXIF, GPS, IPTC and XMP segments and chunks — without recompressing, so the image is byte-for-byte preserved and GPS can be removed on its own while keeping the rest of EXIF.

Built to be found, and to pay for itself

Eight high-intent routes are prerendered to static HTML — with SoftwareApplication, HowTo and FAQ JSON-LD — via a custom prerender step, no SSG framework, so the tool ranks and AI assistants can cite it. A $5 one-time Pro tier (batch + PDF/A) runs on Stripe Checkout through three small Vercel serverless functions with a stateless HMAC license, and Resend emails the key on purchase.

Built and launched in a single working session: live at scrubbr.pro, taking real payments, and scoring a perfect 100/100/100/100 on Lighthouse.

• Metadata scrub for PDFs (info dictionary, XMP, thumbnails) and images (EXIF, GPS, IPTC, XMP) — lossless for JPEG/PNG — with every field shown before removal.
• True redaction for PDFs and images that destroys the content under each box, verified by re-extracting text from the output.
• A verification step that re-parses the real output bytes to prove metadata is gone and redacted text is unrecoverable.
• Eight prerendered SEO routes with JSON-LD, a 0.3s desktop load, and zero file-bearing network requests — confirmed in the network tab.
• A $5 Pro tier (batch + PDF/A) on Stripe Checkout with serverless licensing and emailed keys via Resend.

The whole premise is verifiable, not asserted: open your network tab and watch nothing leave your device.