Blog

PDF metadata: what is hidden in your file and how to remove it

A PDF stores your name in two separate places, and most tools clear only one. Here is how to see what is in your file, and how to take it out.

By Harish7 min read

Every PDF carries a short record of who made it. Your name, the software you used, the minute you started and the minute you finished, and often the name of your employer. You did not type any of it. It was written for you, and it travels with the file wherever you send it. This post shows you where that record lives, why deleting it often does not delete it, and how to check your own file in under a minute.

The nine fields every PDF can carry

Deep inside a PDF is a small block of data called the Info dictionary. The PDF specification, ISO 32000-1, published by Adobe, defines nine fields that can go in it.

Field What it usually holds
Author The name on the account that created the document
Title Often the first heading, or the original filename
Subject A description, if the author filled one in
Keywords Tags the author added
Creator The program the document was written in, such as Microsoft Word
Producer The program that turned it into a PDF, such as Acrobat Distiller
CreationDate When the file was first made, down to the minute
ModDate When it was last changed
Trapped A printing setting. Harmless.

Five of them are worth a thought before you send a file to someone you do not know.

Author is the obvious one. It is normally filled in from the account name on the computer that made the document, so it can hold a full legal name that appears nowhere in the visible text.

CreationDate and ModDate are the quiet ones. Between them they say when you started and when you finished. Send a job application on Monday morning, and the file may also say you wrote it in eleven minutes on Sunday night.

Creator and Producer name the software you used. Usually that is harmless. It matters when the document is meant to look like it came from somewhere else.

The fields nobody shows you

Here is the first thing most guides miss. Those nine fields are the ones the specification defines. Nothing stops a program from adding fields of its own.

Microsoft Word does exactly that. A PDF exported from Word often carries a Company field and a SourceModified field. Neither is in the standard, so neither shows up in the properties panel of Acrobat, Preview, or your browser’s PDF viewer. You open the properties box, see nothing unusual, and decide the file is fine. Your employer’s name is still in there.

This is why our own tool lists standard and non-standard fields separately. The surprises are almost always in the second group.

The second hiding place

A PDF can describe itself in two separate ways, and this is the part that catches people out.

Alongside the Info dictionary, a PDF can hold an XMP packet. That is a block of XML, and it usually repeats the same information: author, title, dates, and the software that made the file. Some programs write only the Info dictionary. Some write both. Adobe products almost always write both.

So a PDF can say “Jane Doe” twice, in two places, in two different formats.

Clear one and leave the other, and the name is still in the file. It is now in the copy your viewer does not display, which is the worst of both worlds. The properties box looks empty, so you think the job is done, and the name is still readable to anyone who opens the file in a text editor.

This is the most common way a cleaned PDF still leaks.

Why deleting it often does not delete it

Now the part that surprises even careful people.

A PDF is not rewritten every time it changes. The format allows an incremental update: the new version is added to the end of the file, and a pointer is changed to say “use this instead”. The old bytes stay exactly where they were. That is a useful feature. It is what lets you sign or review a large document without rebuilding it.

It is also why removing metadata can be an illusion.

ExifTool is the standard command line tool for this job, and it is very good. Its own documentation is blunt about the catch. When it strips metadata from a PDF it does so with an incremental update, so the original metadata is never really deleted. One command brings it back:

exiftool -all= report.pdf              # the file now looks clean
exiftool -pdf-update:all= report.pdf   # and here is everything again

The fix is to rebuild the file instead of adding to the end of it. On the command line that usually means running the result through qpdf, which writes out a fresh file from scratch and simply does not copy across anything that is no longer used.

If you take one thing from this post, take this. Removing metadata and rebuilding the file are two different jobs, and only the second one makes it permanent.

How to check your own file

Three ways, from quickest to most thorough.

1. Your PDF viewer. In Acrobat, use File then Properties. In Preview on a Mac, use Tools then Show Inspector. This takes five seconds and shows the standard fields. It will not show the Company field that Word added, and it will not show the XMP packet, so treat a clean-looking panel as a start rather than an answer.

2. A tool that reads both places. Our metadata remover lists every field it finds, marks the ones that are outside the specification, and tells you separately whether the file has an XMP packet. It runs inside your browser, so the file you are worried about is never uploaded. That was the whole point of building it this way.

3. ExifTool, if a terminal does not scare you. exiftool -a -G1 file.pdf prints everything it can find and groups it by where it came from. This is the fullest view you can get without reading the raw file yourself.

How to remove it properly

A short checklist. It works the same for a job application, a contract, a press release, or a document with a source to protect.

  1. Clean the original document first. If the PDF came from Word, run Document Inspector on a copy before you export. Fixing it at the source is always tidier than fixing it afterwards.
  2. Clear both hiding places. The Info dictionary and the XMP packet. If a tool never mentions XMP, assume it has left it alone.
  3. Make sure the file gets rebuilt, not added to. This is the step most guides skip, and it is the one that decides whether the removal sticks.
  4. Check the result instead of trusting it. Open the cleaned file and look again. Watch for a tool that writes its own name into Producer: it has just put fresh metadata in the space where yours was, which is an odd thing for a privacy tool to do. Ours deliberately writes nothing of its own.
  5. Do the cleaning last. Almost any later edit puts metadata back. Merging, adding page numbers and watermarking all rewrite the file, and most tools sign their work when they do.

What this does not fix

Metadata is only one kind of hidden data. Two things a clean scrub will not save you from.

A black box is not redaction. Drawing a black rectangle over a name in Word or Acrobat hides it from your eyes and from nothing else. The text is still underneath, still selectable, still copyable. The US District Court for the Western District of Louisiana tells filers this directly: highlighting text in black, or putting a black box over it, will not stop the data being seen. The same page warns about “the full-sized version of a cropped picture”. Cropping a photo in Word hides the edges of it. It does not remove them.

Attached files. A PDF can carry other files inside it, and each of those carries its own metadata. A scrubbed PDF with a spreadsheet attached is not a scrubbed document.

Real redaction means taking the content out of the file rather than covering it up. That is a harder problem, and it is the tool we are building next.

The short version

  • A PDF can name you in two separate places: the Info dictionary and the XMP packet. Clearing one and leaving the other is the usual mistake.
  • Word and other programs add fields the specification never defined, and your PDF viewer will not show them to you.
  • Deleting metadata by adding to the end of the file leaves it recoverable. The file has to be rebuilt for the removal to stick.
  • Check the file after cleaning it. Do not take the tool’s word for it, including ours.

Further reading