How to Find Every SSN and Card Number Hiding in a PDF Before You Share It
Published 13 July 2026 · 5 min read
It's a specific, familiar kind of dread: you're about to forward an old invoice, a signed contract, or a scanned form, and a thought stops you — didn't that document have a card number on page 4? Or was it the SSN on the second exhibit? Redaction tools are good at removing whatever you tell them to remove. The harder problem is finding every instance in the first place, especially in a document long enough that a careful read-through still misses one.
Why "just read it carefully" doesn't scale
A one-page form is easy to check by eye. A 40-page loan file, a bundle of exhibits, or a stack of scanned statements is a different story — a stray phone number in a footer, an account number repeated in a table three pages after the one you remembered, or an email address in a signature block are all easy to miss on a single pass, and most people only get one pass before hitting send.
What an automated scan can actually verify
Not every 16-digit number is a card, and not every 9-digit number is an SSN — so a useful scanner does more than match a shape. Card-shaped numbers can be run through a Luhn checksum, the same validity check card networks themselves use, which rules out a meaningful share of coincidental matches. SSN-shaped numbers can be checked against the Social Security Administration's own documented invalid-range rules (no area number starting 000, 666, or 900–999; no 00 group; no 0000 serial). Neither check proves a number is a real, currently active account — only that it's validly formatted, which is exactly the level of confidence worth being upfront about.
The privacy irony of most automated PII scanners
A lot of the compliance and DLP tools built to find sensitive data in a document are themselves cloud services — you upload the file, their server scans it, and it reports back what it found. That's a strange trade for a document you're specifically trying to protect: the exact content you don't want exposed gets sent somewhere else, in full, in order to be told where it appears. A scan that happens locally sidesteps the question entirely, the same way local redaction does.
How FormatDog's Auto-Redact Sensitive Data tool handles this
Auto-Redact Sensitive Data reads a PDF's text entirely inside your browser, runs it against the pattern-plus-checksum logic above, and shows a checklist of everything it found — each one masked to its last few characters, the same convention banks already use, so nothing sensitive is displayed on screen just to confirm it should be redacted. You review the list, leave checked whatever you actually want gone, and it applies the same genuine, page-flattening redaction our Redact PDF tool uses — not a box drawn over content that's still sitting underneath it.
What it will and won't catch
It's built to catch the obvious, well-formatted cases quickly: card numbers, SSNs, emails, and phone numbers. It won't catch a name, a street address, or an internal account number with no standard shape — nothing without a clean, machine-matchable pattern is realistic to detect this way. That makes it a fast first pass that should catch what a manual read-through is most likely to miss, not a replacement for a careful pass with Redact PDF on anything where missing something would genuinely matter.
Checking any of this yourself
The same trick that works everywhere else on this site works here too: open developer tools (F12), click the Network tab, run the scan, and watch for outgoing requests. If nothing resembling your document's content goes anywhere, it stayed on your device the entire time — scanning, review, and redaction included.