How to Trace a Leaked PDF to the Recipient
Short answer: If you send the same PDF to several people and it leaks, you usually cannot tell which copy it came from, because all the copies are identical. To make a leak traceable, give each recipient their own copy with a different invisible mark before you send it. When a copy shows up where it should not, you upload it (a screenshot can also work, such as the top half of a text page, for PDFs marked with the current invisible mark) and the mark identifies which recipient's copy it was. This only works for copies that were marked beforehand.
Last updated: October 9, 2026.
Why a leaked PDF usually points to no one
A deck sent to ten investors, a contract draft sent to four parties, a proposal sent to three agencies: in each case everyone holds the same file. The usual defences leave gaps.
- Metadata (author, creation date, custom properties) can be stripped by re-saving or "print to PDF", and it does not survive a screenshot.
- Visible watermarks such as "Confidential - Ana" can be cropped, covered or edited out, and you have to create each version by hand.
- Link-based sharing and data rooms control who can open a file and often add a visible watermark, but once someone photographs the screen, the control is gone.
What an invisible per-recipient mark does
A forensic watermark hides a different identifier in each copy in a way that is not meant to be visible when reading. Later, a detector reads that identifier back from the file you found.
Markedfile is designed so the mark survives common things that happen to leaked documents: screenshots of pages, recompression, crops and rotation. Detection is heuristic, so there is no 100% guarantee, and a heavily edited or very small piece of a page may not be identifiable. The PDF mark is now invisible; PDFs marked before this change aren't compatible and need to be re-marked.
Every marked file also carries an HMAC metadata mark for that workspace (XMP, EXIF or PNG text in images; XMP and the document Info in PDFs). Markedfile reports a confidence score with each match: about 99% for the exact file, 95% from the metadata mark alone, and about 81% for a re-saved JPEG or a screenshot, where only the visual pattern is left. These are Markedfile's reported confidence scores, not guaranteed detection. Screenshots and many platforms strip metadata, so for a leaked copy the visual pattern is often all that's left.
Mark
Share
Leak
Detect
How to do it with Markedfile
- Before sharing, upload the original PDF and create one marked copy per recipient. Use labels you will recognise later (for example the person or firm).
- Send each recipient their own copy through the channel you already use: email, Drive, a data room, a messaging app.
- If the document leaks, get the version you found. A PDF, an image of a page or a screenshot all work.
- Upload it to Detect. Markedfile reports which recipient's copy it matches.
- Decide what to do. The result tells you which copy leaked. What you do with it (a conversation, ending access, legal follow-up) is up to you.
Files are processed in memory and are not stored. Free covers 5 active files with detection for 6 months, so you can test it on a real document first. For teams, the Business plan ($49.99/month) uses one shared workspace.
What this cannot do
- It cannot trace copies you sent before you used it. It only recognises copies Markedfile marked.
- It does not stop a leak. It tells you which copy leaked, and people tend to be more careful when they know copies are traceable.
- It is not access control or a data room. You can use it alongside one: mark the file first, then upload each copy.
- PDF limits depend on the plan, for example up to 10 pages on Free, 50 pages on Starter ($9.99/month), 100 pages on Pro ($19.99/month), and 500 pages on Business.
FAQ
Can you trace a screenshot of a PDF page? Often, yes, if the mark survived and the screenshot shows enough: roughly 200 pt of a ticket, 160 pt of a photo, 320 pt of a slide, or the top half of a text page. Dense text on its own isn't detected. A PDF screenshot is best effort and is not guaranteed. This applies to PDFs marked with the current invisible mark; older PDF marks aren't compatible, so re-mark older PDFs. Detection is heuristic, so there is no 100% guarantee.
Does this change how the PDF looks? The mark is invisible in normal reading.
Do I need to give recipients a special viewer? No. They receive a normal PDF.
Does it work with a data room like DocSend? Yes, as a complementary step. Mark one copy per recipient, then upload each copy. A data room controls access; Markedfile identifies the copy.
Is the document stored? No. Files are processed in memory and are not stored.
What if the PDF already leaked? Markedfile cannot trace it, because that copy was never marked. Use it the next time you share.
Mark each copy before you share it
Create a free account. You can mark 5 files and see whose copy leaked.