How LeakPrint works

Many copies, one text

A canary trap gives each recipient a slightly different version of a text, then waits to see which version leaks. By hand, that means rewriting a sentence for every person. LeakPrint finds the spots in your document where two forms are equally correct, of the five kinds below, and varies those spots between copies.

The five kinds of marks

• Zero-width spaces after punctuation that another word follows: full stops, commas, colons, semicolons, question marks, exclamation marks and ellipses. Word doesn’t display them.
• Apostrophes inside words, straight (') or curly (’), as in don’t.
• Dashes: a hyphen or an en dash in a spaced dash ( - or – ) and in year ranges such as 2025–2027.
• Ellipses: three full stops (...) or the single character (…).
• Ten word pairs that mean the same: toward and towards, afterward and afterwards, among and amongst, amid and amidst, anyone and anybody, everyone and everybody, someone and somebody, nonetheless and nevertheless, moreover and furthermore, acknowledgment and acknowledgement.

Copies use every place that takes a zero-width space, and about half of the places that take a visible mark; the other half stay as your original has them. At each place in use, each copy gets one of the two forms.

Before you send anything, LeakPrint lists the visible changes in each copy, so you can check them.

Fonts, images, comments, formatting and tracked-change records stay as they are, and parts of the file LeakPrint doesn’t edit stay byte for byte the same. A swapped word can move a line break. The copies don’t record when you made them.

One side effect: Word’s Find can miss a phrase that runs across a marked comma or full stop. Single words are still found.

The key

Your key decides which copy gets which form at each place. LeakPrint first hardens the key with PBKDF2-HMAC-SHA-256 with 600,000 iterations, then picks the forms for each place with HMAC-SHA-256 of the words around it. It stores nothing: the same text and the same key always give the same copies.

Choose a long key, or click Suggest a key, and keep it with your list of who got which copy. Without the key, nobody can work out which copy has which number, LeakPrint included.

Identifying a leaked copy

LeakPrint finds the same places in the leaked file, reads which form each one has, and compares the result with the pattern of every copy number from 1 to 10.

For a copy the file didn’t come from, each place agrees about half the time, like a coin toss. LeakPrint works out the exact chance of agreeing as often as the file does by luck alone. It names a copy only when that chance is below one in a million, after allowing for ten copy numbers and six ways of counting the marks: all of them together, and all but one kind. A leaker who straightens every apostrophe doesn’t throw it off.

If a second copy also matches, or agrees more often than chance would explain, LeakPrint tells you: the file may combine copies. With the wrong key, or a file that isn’t one of the copies, no copy matches.

What it survives

In tests with Microsoft Word 16, a leaked copy stayed identifiable after:

• Opening and saving it again
• Removing personal information with Document Inspector
• Saving it as .doc, .odt or .rtf and back to .docx
• Pasting its text into a new document, with or without formatting
• Light edits to the text

Not tested yet: LibreOffice and Google Docs.

What it can’t do

• Read printouts, PDFs, screenshots or photos of a document
• Survive retyping, or a leaker who compares two copies and evens out the differences
• Trace a document you sent before you made copies with LeakPrint
• Keep the zero-width spaces hidden from someone who turns on formatting marks (¶), which can show them
• Mark a document with a digital signature, an old .doc file or a password-protected file

Privacy

LeakPrint runs in your browser. A background worker in the page opens the .docx, makes the copies and checks leaks, all on your computer.

The server only hands out the site’s own files. It answers any request other than reading a page with an error, and the page’s security policy blocks connections to every other site. LeakPrint has no accounts, no analytics and no cookies.

You can check this yourself: open your browser’s developer tools on the Network tab while you make copies. No request carries your document.