Hidden Metadata in PDFs: What Your File Reveals About You

A PDF carries more than the pages you can see. Alongside the content sits a layer of descriptive data - who made it, with what, when, and sometimes on which computer - that no reader displays by default and most people never think about. Usually it's harmless. Occasionally it's the most revealing part of the document.

What's typically in there

The standard document information fields are present in almost every PDF:

• Author - often your real name or computer account name, filled in automatically by whatever created the file.
• Title, Subject, Keywords - sometimes descriptive, sometimes a leftover from a template.
• Creator - the application the document was written in.
• Producer - the library or driver that generated the PDF, usually with a version number.
• Creation and modification dates - timestamps, frequently including your time zone.

The Author field is the one that surprises people. It's populated from your operating system or office suite account, so a document you thought was anonymous may be signed with your full name without you ever typing it.

The less obvious passengers

Beyond the standard fields, a PDF can carry a good deal more:

• XMP metadata - a richer parallel block that can retain history from the source document, including earlier titles and authors.
• Annotations and comments - review notes, often with the commenter's name attached.
• Form field values - data typed into a form that looks blank when printed.
• Embedded attachments - entire files carried inside the PDF; a source spreadsheet can travel invisibly with a report built from it.
• Bookmarks - section titles that can describe content you removed from the pages.
• Embedded image metadata - photos placed in a document may still hold their own EXIF data, including camera model and sometimes GPS coordinates.

That last one deserves emphasis. A photograph taken on a phone with location services enabled records where it was taken. Place it in a document and the coordinates can ride along into the PDF.

When it actually matters

For most documents it doesn't, and stripping metadata from everything you send is unnecessary effort. It's worth attention in specific situations:

• Anything published anonymously or pseudonymously - the Author field alone can undo the intent entirely.
• Documents sent to an opposing party - in a dispute, negotiation, or legal matter, timestamps and edit history can be informative in ways you didn't intend.
• Templates reused across clients - the Title field is a classic way one client's name reaches another's desk.
• Anything you've redacted - metadata is not covered by redaction and routinely survives it.
• Photos of your home or workplace - for any GPS data embedded in the images.

How to look, and how to remove

Checking takes seconds. In Adobe Acrobat, File → Properties shows the standard fields; in macOS Preview, Tools → Show Inspector does the same. Both will also reveal an attachments panel if one exists. For a thorough look - XMP blocks, embedded files, annotations - you want a dedicated tool such as exiftool, which runs locally and reports essentially everything a file carries.

For removal, Acrobat has a "Sanitize document" function that strips metadata, attachments, and hidden data in one pass. Be careful with exiftool here: it is excellent for inspecting a PDF, but when it "clears" PDF metadata it only appends an update marking the old values as deleted. They stay in the file, and exiftool itself warns that they can be recovered. HerePDF's metadata tool writes a fresh copy of the file instead, so cleared values, and any left behind by earlier edits like that, are not carried over. A cruder route that reliably discards everything: export the pages as images and rebuild the PDF from them - no original metadata survives, though you lose text selectability and the file grows considerably.

For images specifically, strip EXIF before placing them in a document rather than trying to clean up afterwards. Most phones can share photos without location data if you ask them to.

What HerePDF does with metadata

None of the other tools are sanitisers, but they don't all behave the same way. Rotate and compress open the document and save it again, so the properties it arrived with come out unchanged. Merge and split build a new file and copy the pages into it, and the document properties are not among the things copied, so the result carries none of them. That is a side effect of how the file is rebuilt, not a scrub: page-level content travels across intact, so annotations, form values and any EXIF inside embedded images are all still there. Don't treat either as a way to clean a document.

The metadata tool is built for the opposite job. It clears the document properties - title, author, subject, keywords, producing software, timestamps, and any non-standard fields an application left behind - and can strip EXIF from JPEG photos embedded in the PDF too, on by default, without recompressing the image. If the file carries XMP, the tool says so and removes it, again on by default. That removal is a real one: dropping the document's pointer to the XMP block is not enough on its own, because the library the tool is built on still writes an unreferenced block into the saved file. So the tool also deletes the block itself, along with any XMP attached to individual images or pages. Image to PDF now strips EXIF from photos as they're added, so a PDF built entirely on this site no longer carries camera or GPS data from the start - that was a real gap before this tool existed.

What the metadata tool does not touch is everything outside metadata proper: comments and their authors' names, bookmarks, form values and embedded attachments all come through unchanged. If those matter too, a full sanitiser such as Acrobat's is the thorough route - and exiftool is the quickest way to check what a file still carries afterwards.

Worth separating two ideas that sound similar. Everything here runs in your browser, so we never receive your file or its metadata - that's about who can see the document. It says nothing about what the document reveals to whoever you send it to next.