What PDF metadata reveals about you

Guides · Updated 12 August 2026 · 8 min read

Every PDF carries a second document alongside the one you can see: who created it, with what software, when, and sometimes what it said before you changed it. Most of the time this is harmless. Occasionally it is the most sensitive thing in the file.

The document information dictionary

The oldest and simplest layer is a dictionary of standard fields, filled in automatically by whatever produced the file:

• Title, Subject, Keywords — often left as whatever the template had.
• Author — the one that surprises people. Office suites populate it from the operating system account name, so a document written on a work laptop routinely carries a full legal name, and sometimes a username of the form firstname.lastname that maps directly onto a corporate email address.
• Creator — the application that authored the content (Microsoft Word, LaTeX, InDesign, a scanner's driver).
• Producer — the library that wrote the actual PDF bytes, usually including a precise version number.
• CreationDate and ModDate — timestamps, complete with the UTC offset of the machine that made the file, which discloses a rough geographic location and, read together, how long a document sat between being created and being finalised.

A second, newer layer called XMP holds the same information as an embedded XML block, plus anything the producing application chose to add — editing history, document identifiers that persist across "save as", and in files from design software, occasionally the names of every contributor.

Why it matters more than it looks

Taken one field at a time this is trivia. The problem is that metadata is invisible during the review that precedes sending a document — you proofread the pages, not the header — so it survives processes that are otherwise careful.

Some recurring situations where it bites:

• Anonymous submissions that are not. Blind peer review, anonymised tenders, whistleblowing, applications reviewed without names: the visible text is scrubbed and the Author field still holds the real one.
• Templates that betray their origin. A proposal built by copying a previous client's file inherits its Title and identifiers. Sending "Offer — Acme Corp" to Acme's competitor is a bad way to disclose your client list.
• Timelines that contradict the story. In any dispute, a creation date that post-dates the event a document supposedly records is exactly the kind of detail the other side looks for first.
• Software inventory. The Producer string names a library and its version. Sent outside your organisation at scale, that is a small but real reconnaissance gift.

The bigger problem: content that is hidden rather than removed

Metadata is the well-known half. The half that causes actual incidents is content still present in the file but not visible on screen.

Black rectangles are not redaction. Drawing a filled shape over a name adds a drawing instruction on top of the text. The text objects underneath are untouched: select the area and copy, or extract the page's text stream, and it is all there. This is the single most repeated document-security failure in existence, and it has embarrassed governments, law firms and newspapers alike. Real redaction deletes the underlying objects and rewrites the file.

Cropping usually hides, it does not cut. Cropping a page adjusts the visible box; the content outside it remains. Cropping an image often does the same — the pixels you cropped away are still in the image stream.

Exported comments and tracked changes. Depending on export settings, a PDF made from a word processor can carry annotations, review comments, or the remains of tracked changes. Comments live in annotation objects that a reader may not display by default but any parser can list.

Earlier revisions. Because PDF allows a writer to append changes rather than rewrite the file, a document that has been edited several times can contain its own earlier states. The previous cross-reference tables are still there, and recovering a superseded version is not difficult.

How to inspect a PDF before sending it

A quick, escalating checklist:

1. Read the properties. Every PDF reader exposes them — in Acrobat it is File → Properties; most others call it Document Properties. Check Author, Title, Creator and Producer specifically. In PDFLight, the same fields are under Tools → Metadata.
2. Select all and copy. Press Ctrl+A then Ctrl+C on the page and paste into a text editor. Anything that appears which you cannot see on the page is text hidden under a shape or drawn invisibly.
3. Search for what should not be there. Use Ctrl+F to look for a name you believe you removed. If the search hits, the word is still in the file.
4. List the annotations. Open the comments or annotations panel. An empty panel is what you want.
5. Compare file size against content. A three-page document weighing 12 MB is carrying something you are not looking at — usually a full-resolution image behind a crop.

How to actually clean a file

Ranked by how much they really remove:

• Overwrite the metadata fields. Setting Author, Title, Subject and Keywords to empty or neutral values handles the information dictionary. Note that many tools leave the Producer field pointing at themselves, which is normal and rarely sensitive.
• Rebuild the document from its pages. Copying the pages into a brand-new file discards the document-level metadata, the earlier revisions and anything that was not attached to a page. This is a genuine cleanup rather than a cosmetic one — and it is what any tool that reconstructs a PDF from a page list does by design, which is why metadata usually has to be written back deliberately after an edit.
• For true redaction, remove then flatten. Delete the underlying content with a real redaction tool, or — the crude but reliable method — export the page as an image and rebuild a PDF from that image. Rasterising destroys the text layer along with everything hidden in it. You lose selectable text, which is exactly the trade you are making.
• Rename the file. The filename travels with the document through every system it touches, including logs and mail servers. It deserves the same review as the contents.

Frequently asked questions

Does removing metadata change how the document looks?

No. The information dictionary and XMP block are separate from the page content, so clearing them leaves every page pixel-identical.

Can a PDF track when it is opened?

A plain PDF cannot. A PDF that references a remote resource — an external image, a form action, JavaScript — can cause a request when opened in a reader that allows it, which reveals an IP address and a timestamp. Most modern readers block this by default and ask first. It is also one of the reasons PDF/A forbids external references.

Is the Producer field worth clearing?

Rarely. It names the software that wrote the file, not you. It is the Author, Title and timestamps that carry personal information.

Do printing to PDF or "Save as PDF" strip metadata?

They usually replace it rather than remove it: you lose the original history but the new file gets fresh Author and Producer fields from the machine doing the printing — often the same account name you were trying to avoid disclosing.

Is metadata removal enough to anonymise a document?

No. Writing style, template details, embedded fonts, the internal reference numbers on the page and the file name all identify a source. Metadata is the easiest layer to clean, not the only one.

Further reading

• What is actually inside a PDF file
• What happens when you upload a PDF to an online tool
• Why PDF files get so large