Inspect PDF text layers, detect visual masking, and export an audit report. Open the browser tool or run the Python utility locally.
Open-source PDF audit tool
Taylor Wessing Data Breach Toolkit
On this page
Inspect the text and drawing layers in a PDF, identify text hidden beneath visual masks, and export a report or an unmasked copy. The toolkit includes a browser interface and a Python command-line utility.
Removing a mask reveals content; it does not securely redact a document. Use a copy of the source PDF and inspect the output before sharing it. A scan result alone does not establish that a document is safe to publish.
Open the browser tool
- Open the PDF Redaction Auditor.
- Select a local PDF. Compare its rendered page with the text extracted by PDF.js.
- Export the audit report, or use the layer-stripping action to download a separate, unmasked PDF.
The document is processed in the browser. Loading the hosted interface downloads the application and its libraries. The repository includes the browser libraries locally; for an offline copy, download the repository and keep its lib/ directory beside index.html.
Run the Python tool locally
Download decensor.py from the project repository. Install Python 3 and PyMuPDF, then run the commands from the folder containing the script. Installing dependencies requires a connection; processing the PDF runs locally.
python -m pip install pymupdf
python decensor.py --helpInspect the document structure
python decensor.py -i document.pdf -lExport text detected beneath dark shapes
python decensor.py -i document.pdf -e findings.txtRemove supported vector masks from a copy
python decensor.py -i document.pdf -m stream -o unmasked.pdfKeep only the text layer
This mode removes all vector drawings, lines and boxes, including legitimate graphics. Preserve the original for comparison.
python decensor.py -i document.pdf -d -o text-only.pdfWhat each mode checks
- Text inspection · browser
- PDF.js extracts the stored text and displays it alongside the rendered page.
- Layer stripping · browser and Python
- PDF-lib or PyMuPDF modifies supported drawing operators to reveal text beneath visual overlays.
- Collision audit · Python
- PyMuPDF checks overlaps between text blocks and dark shapes. The
-eoption writes the detected text to a report.
These checks target supported visual masking patterns. They cannot reconstruct text that was actually deleted, and they do not provide a complete audit of every PDF object, attachment or redaction method.
Source and documentation
Case study and correspondence
📊 Case Study: The Taylor Wessing / Valve GDPR Breach
While processing Article 15 GDPR subject access requests (SARs) concerning Steam user data, a critical security vulnerability was identified in documents processed and transmitted by the external legal counsel Taylor Wessing LLP on behalf of Valve Corporation.
Technical Failure Analysis
Instead of permanently sanitising the raw character arrays inside the PDF content streams, a custom automated PDF generation pipeline (using Aspose.PDF for .NET) was deployed. This system programmatically queried the coordinates of sensitive fields and drew solid black vector shapes (using the PDF re and f/F/b/B operators) on top of the text.
Because visual drawing layers neither alter nor destroy the underlying raw text arrays, thousands of unredacted private records (including account credentials, logins, emails, security logs and de-anonymised data of minors) remained fully intact, copyable and extractable from the files that were sent.
📂 Exhibit A: Disclosed Correspondence with Dr. Patrick Zurheide
The project README reproduces the response received from Dr. Patrick Zurheide, the Salary Partner at Taylor Wessing LLP, after PhishDestroy formally notified the firm of their PDF redaction failure and the resulting Steam user data leak. Instead of initiating an Article 33 GDPR breach notification, he wrote the following (English translation; the German original is linked in the README):
Hello PhishDestroy team,
Thank you for your seemingly translated, but quite entertaining message. Which communication "with criminal prosecution" addressed to the PhishDestroy team are you referring to? I am certain that I have never communicated with PhishDestroy in any form before. Please therefore provide this alleged communication so that I can understand what this is all about.
Your letter is unfortunately difficult, if not impossible, to follow in terms of content. As a note: A disclaimer, such as the one at the bottom of your letter, stating what is allegedly not done or intended, is meaningless if the actual actions contradict it.
Patrick Zurheide
🔍 PhishDestroy Analysis:
- "entertaining message": A very well-paid "IT Law Expert" called a forensic notification about a massive GDPR data breach involving the exposed Steam accounts of minors "entertaining".
- "difficult, if not impossible, to follow": We gave him the exact hex values, his PDF's metadata, the 36-second batch pipeline timestamps and the specific Aspose 20.8 version that caused the leak. Apparently, IT metrics are too "difficult to follow" for a Doctor of Information Technology Law.
LICENSE · RIGHTS · DISCLAIMER
PHISHDESTROY
LICENSE · RIGHTS · DISCLAIMER
Investigation: Valve Corporation / Steam · public — no expiry date, no take-backs
MIT PUBLIC DOMAIN OFAC-RESTRICTED
SECTION I — LICENSE
PhishDestroy gives up every right to this material. Zero. Gone. Done. You can reproduce it, sell it, put your name on it, tattoo it on your boss, whatever. No credit required, no DM needed, no thank-you card expected.
ONE ACTUAL RULE
If you are a user from Russia or any OFAC-sanctioned country — this material is NOT for you. No loopholes. Enjoy your sanctions. And if you switched your Steam region to Turkey while sitting in Moscow — congratulations on your creative geography. You're still Russian. The sanctions still apply. That's literally the point.
SECTION II — WHAT THIS IS AND WHY IT EXISTS
We will publish more about Valve than an average Valve employee knows about themselves. Steam basically created us. It raised us on its scammers, its support tickets, its ban evasion ecosystem — and here we are. No hard feelings. Poetic, actually. We waited over 4 years for them to fix the spoofing issue before we could write about it publicly. Is this a conflict? No. Can it be resolved? Yes. But we're not signing any NDA and we're not playing bug bounty for pennies.
SECTION III — OPEN LETTER TO VALVE
Valve: if you want this domain taken down, email us. Outside counsel is not needed for that conversation.
Will we damage Valve directly? Probably not in a way they'll feel fiscally. We're not delusional. But we will do it honestly, openly, without chasing clout. We have 5 years of archives. Regulators get the originals. Researchers and journalists get redacted versions. PhishDestroy is a community, not a person.
THE DEAL (open offer, no lawyers needed)
If you want the domain gone: let your IT law professionals calculate the price. 50% goes to the SEAL Foundation. We kill the domain. No drama. No court. Done. You won't get it any other way. This is not a threat. It is just the architecture of the situation.
SECTION IV — THE MONEY, THE BANS, THE WHOLE CIRCUS
Here's the thing about Steam banning gambling sites and scammers: it's not enforcement. It's revenue capture. Valve pockets the money, cleans its hands, then goes on stage and tells everyone a wholesome story. Meanwhile Valve killed the ability to properly track skins in 2017. We are going to prove it: skins are more anonymous than Monero. A Peruvian cartel allegedly used Dota 2 skins for money movement. Steam is functionally a sanctions-bypass machine worth about $7 billion in "trading cards".
SECTION V — THE MALWARE THING
We are not disclosing the vulnerability in the game publicly, and we are not filing it through Steam's bug bounty. The programme requires an NDA, and signing one would bar us from telling affected users what happened to their accounts. Our security colleagues have already reported it to Steam support. This is NOT the trivial CSGO variant. It is closer to: RCE on server connect. As in — you join a server, you don't click anything. The connect itself is the attack surface. The threat is active.
DECLARATION AS TO USE AND RIGHTS
PhishDestroy Project & Cybersecurity Coalition
1. THERE ARE NO CONDITIONS ON USE
All material produced by the Coalition in this referral — the statements of fact, the analysis, the exhibits, the tooling and the findings — is released WITHOUT RESERVATION OF ANY RIGHTS. Anyone may reproduce it, adapt it, edit it, rewrite it, translate it, excerpt it, incorporate it into official documents, present it as their own work or pass it on to anyone else — without asking and without notifying the Coalition.
2. WHY THIS MATTERS PRACTICALLY
There is nothing here to be entangled with. The Coalition asks for nothing, is owed nothing, retains nothing, and has no expectation of any kind. An authority using this material is not acting for the Coalition. It is using public information that happens to have been assembled by someone else.
3. EVERYTHING IS OPEN ALREADY
The investigations are published openly at phishdestroy.io. The tooling is published as open source under the MIT licence at gitlab.com/phishdestroy. The methodology is set out in the referral. The Coalition accepts no donations and has published that position since 2018.
4. INTEGRITY OF THE EVIDENCE BUNDLE
Each delivery is accompanied by a file SHA256SUMS listing a SHA-256 digest for every file supplied, together with a detached OpenPGP signature SHA256SUMS.asc. The signing key is published at phishdestroy.io/.well-known/pgp-key.txt and on keys.openpgp.org.
5. ON REGISTER
The authority may encounter the Coalition's published investigations and find them blunt, adversarial and at times satirical. That impression is correct. The Coalition writes that way deliberately. The waiver is the mechanism by which the substance can be separated from the register: the authority may take what is useful, restate it in its own voice, and discard every word of the Coalition's manner. Nothing is lost by doing so.
6. WHAT THE COALITION IS PROVIDING
Information, research and observation. Nothing is asserted as a finding that the Coalition has no standing to make. The Coalition seeks no remedy, no payment, no acknowledgement and no outcome for itself. It asks only that the questions set out in the referral be put to Valve Corporation by a body with the power to compel an answer.
CLOSING NOTE — TO WHOEVER IS CARRYING THIS FORWARD
We want to thank whoever gets this material to where it needs to go. Valve has deep pockets and Taylor Wessing charges by the hour. We know what we're doing. We know who we're writing about. We don't need authorship. We don't need attribution. We don't need a win. We need someone with actual authority to ask Valve the questions that are already sitting in this referral, with the power to require an answer. That's it. That's the whole ask.
PhishDestroy — public investigation — all rights surrendered to humanity · OFAC-region access: prohibited
Additional editorial notes
┌─────────────────────────────────────────────────────────────────────────┐ │ ONE ACTUAL RULE (yes, just one) │ │ │ │ Access from OFAC-sanctioned jurisdictions is prohibited. That is a │ │ matter of territory and law — not of nationality and not of people. │ │ Changing your Steam region does not change your physical location │ │ or your legal status. No loopholes. │ └─────────────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────────────┐ │ THE DEAL (open offer, no lawyers needed) │ │ │ │ If you want the domain gone: │ │ let your IT law professionals calculate its price. Take your time — │ │ it is a rare asset: the only website in the world whose purchase │ │ changes nothing, because everything on it already lives on IPFS, │ │ in regulator inboxes, and in archives we do not control. │ │ │ │ 50% of whatever you pay goes to the SEAL Foundation │ │ (securityalliance.org) — people who do volunteer security work │ │ professionally and publish it for free. We are not affiliated with │ │ them and they did not ask for this; we name them as the public │ │ standard of what real volunteers look like — the standard your own │ │ volunteer moderators and outsourced support failed, publicly, │ │ before you had to remove them. You know the scandals. So do we. │ │ │ │ The rest buys the community coffee while we keep publishing. │ │ That is not a settlement offer. It is a demonstration of what │ │ money can't reach: the domain is the maximum Valve can obtain, │ │ and obtaining it obtains nothing. The referrals continue. │ │ The mirrors continue. Part 3 continues. │ └─────────────────────────────────────────────────────────────────────────┘