Before You Send That PDF: A Five-Minute Checklist

A PDF that looks finished on screen can still carry things you did not intend to share. None of the checks below takes long, and each one corresponds to a mistake that actually happens.

1. Properties: who and what made it

Documents record an author, a title, the software used and the dates created and modified. They often name a person or a company machine you did not mean to identify. The metadata tool lets you read, edit or clear these fields, plus any custom keys the creator added. Many files also carry a second copy of the same details in an XMP metadata block, which most viewers never show. The tool tells you when one is present and, unless you untick the option, removes it along with the fields, so clearing the visible properties is not undone by a hidden duplicate. Hidden metadata in PDFs goes into more detail.

2. Photos inside the file

Pictures taken on a phone carry EXIF data - camera model, settings, sometimes GPS coordinates. If a PDF was made from such photos, that data can travel with them. The metadata tool has an option to strip EXIF from embedded JPEGs, and HerePDF's image to PDF tool strips it from photos as it builds a PDF, so a document made there does not carry your location.

3. Comments, attachments and scripts

A PDF can carry more than its pages: review comments (with their authors' names), files attached to it, scripts that run when it opens, thumbnails, and answers typed into form fields. None of it shows on the page unless you look. The remove hidden data tool lists what a file holds in each of those groups and removes the ones you tick, then drops the removed objects from the file itself. Comments, attachments, scripts and thumbnails are ticked when the file has them; form answers are cleared only if you tick them, and the field stays fillable. It leaves links, layers and digital signatures alone, and it does not touch anything drawn on the page, text hidden by colour, or anything inside a picture. If you want comments and form answers to stay visible but stop being editable, flatten draws them into the page instead. Flatten keeps sticky-note comments as notes, because drawing one would leave an icon whose text can no longer be opened, so use remove hidden data for those.

4. Covered is not removed

If any part of the document was hidden with a black rectangle, a white box, a highlighter or a crop, assume the content is still in the file. Selecting and copying across the hidden area shows a box, a highlighter or a white rectangle, but not a crop: a viewer built on PDF.js will not select text outside the visible page, and it is still in the file. To genuinely remove content, use the redact tool, and read why hiding text in a PDF usually doesn't remove it first. See also cropping a PDF: what stays hidden in the file, because a crop hides content the same way. Redaction leaves document properties alone, so do check 1 as well.

5. Size

If the file will go by email or through an upload form, check it against the limit now instead of discovering the problem at the last minute. PDF too big to email? lays out what works and in what order.

6. Marking it, if appropriate

If the file is a draft or a sample, a watermark can say so at a glance. Treat it as a label, not protection - it is drawn on top of the page and can be removed. Watermarking a PDF and what it doesn't protect you from covers the details. If you need to stop people opening a file without a password, the password protect tool adds one in your browser; password-protected PDFs explains what a password does and doesn't stop.

7. Open it as the recipient will

Reopen the finished file in a different viewer than the one you used and scroll to the end. Check the comments panel too: comments can carry their author's name. The remove hidden data tool in check 3 deletes them. The redact tool does not: it rebuilds the pages you mark, and in comments on other pages it only replaces the redacted words with "[redacted]" where a comment quotes them, so the comment and its author stay. Opening the file as the recipient will is a minute of work that catches most of what the earlier steps miss.

Why these mistakes keep happening

Every item in this list is invisible in normal use. Metadata does not appear on the page. Hidden text does not appear on the page. EXIF data is inside a photo, not on it. Because nothing looks wrong, nothing prompts a second look, and the problems are found by the recipient, or by someone who later gets hold of the file. A checklist is the right response to an invisible risk, because it does not depend on noticing anything.

How much checking is proportionate

For a casual file to a friend, the checklist is overkill; a glance at the properties is plenty. For a document going to a landlord, a court, a journalist, an employer or a public website, run all of it. The more the file will be passed along - and the less control you will have over who sees it - the more of these checks matter. A file posted publicly is effectively sent to everyone, including people who will look at it with specialised tools.

A sensible order

Do the edits that change content first - redaction, cropping, page deletion, merging - then check size, then remove hidden data and clear metadata, since some of those operations touch the file and those two should reflect the final version. If you are adding a password, do that very last: to change an encrypted file in another HerePDF tool you have to type its password on opening, and what that tool saves is no longer password-protected. Keep the original untouched so you can start again if a step goes wrong. Give the outgoing version a new name so you cannot attach the wrong one.

What this checklist does not cover

It does not tell you whether the document's content is accurate, whether the recipient is trustworthy, or whether email is a suitable channel for it. It also cannot protect a file once it has been sent; anything the recipient can open, they can copy and forward. It reduces what the file reveals beyond what you intended, which is a narrower and more achievable goal.

All of these checks run locally in your browser, so the file you are trying to keep private is not sent anywhere in the process of checking it.