A Word file remembers more than it shows you. The clause your colleague deleted is still in there with their name on it. So is the comment somebody marked resolved, the paragraph formatted as hidden, the matter number your document system stamped into a custom property, and — the one almost nobody knows about — the whole of every photograph you cropped, because cropping in Word hides pixels rather than removing them.
Word can show you most of this if you know where to look, and on a Mac some of it takes four separate places: the Reviewing Pane for changes and comments, the Crop tool one picture at a time, Preferences for the hidden-text display setting, and Backstage for the metadata. Word's one-click Document Inspector, which does it in a single pass, exists on Windows only — Microsoft's own documentation says Word for Mac "doesn't have a document inspector" and that inspecting a document "isn't currently possible in Word for the web". And even the Windows one removes without ever showing you what it is about to remove.
docxray is the single pass, on any platform, showing rather than removing. It is not a capability Word lacks — it is the audit Word makes you assemble by hand, every time, on a file you are about to send.
.docx is a ZIP of XML parts, so no rendering
engine and no upload is involved — the file is read as data.
It could rebuild the package with the findings stripped out, and that is precisely why it does
not. Rewriting an OPC package means taking ownership of
[Content_Types].xml, every _rels part and every relationship in the
document. Get one wrong and Word greets your recipient with a repair dialog on a contract —
which is a worse outcome than the disclosure. Revealing is a read; removing is a rewrite, and
the tool that does the rewrite should be the one that wrote the file.
docxray reports what the bytes of the file record and stops there. It does not judge whether a document is safe to send, does not infer who wrote what from save identifiers, and does not guess at anything it cannot read. Where a producer simply does not write a particular kind of record, it says the record is absent rather than that the document is clean of it.
localStorage; document content
never does. A build gate checks the shipped JavaScript for the storage APIs it must not
contain.
.docx, so it cannot corrupt the document it is
inspecting.
feedback.benrichardson.dev. Nothing is
sent unless you open the feedback form and press Send; your files and data never are.
docxray opens a Word document and shows you what is still inside it — the tracked changes, the comments, the hidden text and the cropped-away parts of photographs — before you send it to somebody outside your organisation.
It is built and maintained by Ben Richardson. The rest of the catalogue of tools and sites lives at lab.benrichardson.dev.
Source: github.com/ben-gy/docxray.
fflate, MIT.The sample contract is fictional and was written for this tool. The company, the people, the photographs and every clause in it are invented.