检查 PDF
一份关于文档结构、安全、隐私和可读性的报告。
这款工具完全在你的浏览器中运行。文件从不上传，你可以在浏览器的网络标签中亲自验证这一点。 亲自验证：打开浏览器的网络标签观察。你会看到一个查询你是否还有剩余任务的小请求，只包含工具名称和一段哈希，绝不会包含文件。
这款工具的作用
This reads a document and reports on it rather than changing it. Four passes answer four different questions: is the file structurally sound, is it locked, what does it give away about whoever made it, and can a screen reader read it. Every finding that has a fix names the tool that applies it, so the report is something you can act on instead of a list of things to worry about.
Before sending a document you did not create, or one you did: to see what metadata is riding along, whether there are attachments you had forgotten, whether it is a scan that nobody's screen reader can read, or why another program refuses to open it.
工作原理
- Drop the PDF onto this page. Nothing is written back to it - inspection is read-only.
- Leave all four checks on for a full report, or switch off the ones you do not need.
- Press Inspect. Three engines are used: qpdf for encryption and structure, pdf-lib for metadata, attachments and links, PDF.js for the text layer.
- Read the report. Each finding is marked ok, information, warning or danger, and the ones that can be fixed carry a link to the tool that fixes them.
- Keep the report as a web page, or switch the format to JSON under advanced options if a machine is going to read it.
The structural pass runs qpdf's own check, which walks the cross-reference table and the object streams and reports whatever does not add up. A warning here is usually why some other program refuses to open the file, and Repair PDF is usually the answer. A clean check is a stronger statement than it opened on my machine.
The security pass separates the two kinds of protection people confuse. A document may be encrypted so that it cannot be opened without a password, or encrypted with an empty password so that it opens for everyone and merely declares restrictions. The report says which it is, how many bits the handler uses, and lists the permission lines exactly as qpdf reports them. It does not verify signatures - that is Verify signature's job.
The privacy pass is the one that surprises people. A PDF routinely records who created it, which program produced it, and sometimes the full path of the file on that person's disk; it can carry attachments nobody remembers adding, and links to hosts you might not want to be seen visiting. The report names the identifying fields, lists the attachments, and shows only the hosts of external links.
The accessibility pass is the one almost nobody else runs. It checks whether the document has a text layer at all - five pages sampled evenly across the whole document, because a cover sheet is often the only page with real text in an otherwise scanned file - and whether the document has a title and an outline. Without a text layer the file is a picture of a document.
这款工具做不到的事
- The text-layer check samples five pages spread across the document, so a file with real text on only a page or two can be reported either way.
- The signature line reports whether form fields exist; it verifies nothing. Use Verify signature for an actual answer.
- The accessibility pass looks for a text layer, a title and an outline. It is not a PDF/UA conformance test - tags, reading order and alternative text are not examined.
- A document that needs a password to open can only be reported on from the outside; its metadata, attachments and text layer cannot be read until it has been through Unlock PDF.
常见问题
- 这份报告会告诉我什么？
- 页数、PDF 版本和文件大小；结构是否通过 qpdf 的检查；文件是否加密、带哪些权限；它携带了哪些能识别身份的元数据、附件和外部链接；以及它有没有文字层、标题和书签。每一项都会评级，能补救的会直接链接到执行补救的工具。
- 一个 PDF 能装下哪些个人信息？
- 比多数人以为的多。作者的名字、生成它的程序，有时还有制作它的那台机器上的完整文件路径，都作为普通的文档属性存着，被到处转发也留得下来。文件还可能携带没人看过的附件和链接。
- 我怎么判断一个 PDF 是否无障碍？
- 第一个问题是它有没有文字层，这份报告通过从整份文档中抽取五页来回答它。没有文字层，它就是一张文档的照片：任何屏幕阅读器都读不了，搜索也找不到任何东西，这可以用「PDF 转文字（OCR）」修复。报告还会指出缺失的标题，以及超过二十页的文档缺失的大纲。
- 它发现了问题。我现在该怎么办？
- 顺着链接走。结构警告去「修复 PDF」，缺失文字层去「PDF 转文字（OCR）」，能识别身份的元数据去「删除元数据」，附件去「净化 PDF」，缺失标题去「编辑元数据」。一个让你自己去琢磨要搜什么的提示，用处不大。
- 检查时文件会被上传吗？
- 不会。这项检查由三个引擎以 WebAssembly 和 JavaScript 的形式运行在你浏览器的 Web Worker 里，报告也在那里生成。也不会有任何东西被写回文件。页面加载过一次后，它在断网状态下也能用。