Hidden Metadata in PDFs: What Your File Reveals About You

A PDF carries more than the pages you can see. Alongside the content sits a layer of descriptive data — who made it, with what, when, and sometimes on which computer — that no reader displays by default and most people never think about. Usually it's harmless. Occasionally it's the most revealing part of the document.

What's typically in there

The standard document information fields are present in almost every PDF:

• Author — often your real name or computer account name, filled in automatically by whatever created the file.
• Title, Subject, Keywords — sometimes descriptive, sometimes a leftover from a template.
• Creator — the application the document was written in.
• Producer — the library or driver that generated the PDF, usually with a version number.
• Creation and modification dates — timestamps, frequently including your time zone.

The Author field is the one that surprises people. It's populated from your operating system or office suite account, so a document you thought was anonymous may be signed with your full name without you ever typing it.

The less obvious passengers

Beyond the standard fields, a PDF can carry a good deal more:

• XMP metadata — a richer parallel block that can retain history from the source document, including earlier titles and authors.
• Annotations and comments — review notes, often with the commenter's name attached.
• Form field values — data typed into a form that looks blank when printed.
• Embedded attachments — entire files carried inside the PDF; a source spreadsheet can travel invisibly with a report built from it.
• Bookmarks — section titles that can describe content you removed from the pages.
• Embedded image metadata — photos placed in a document may still hold their own EXIF data, including camera model and sometimes GPS coordinates.

That last one deserves emphasis. A photograph taken on a phone with location services enabled records where it was taken. Place it in a document and the coordinates can ride along into the PDF.

When it actually matters

For most documents it doesn't, and stripping metadata from everything you send is unnecessary effort. It's worth attention in specific situations:

• Anything published anonymously or pseudonymously — the Author field alone can undo the intent entirely.
• Documents sent to an opposing party — in a dispute, negotiation, or legal matter, timestamps and edit history can be informative in ways you didn't intend.
• Templates reused across clients — the Title field is a classic way one client's name reaches another's desk.
• Anything you've redacted — metadata is not covered by redaction and routinely survives it.
• Photos of your home or workplace — for any GPS data embedded in the images.

How to look, and how to remove

Checking takes seconds. In Adobe Acrobat, File → Properties shows the standard fields; in macOS Preview, Tools → Show Inspector does the same. Both will also reveal an attachments panel if one exists. For a thorough look — XMP blocks, embedded files, annotations — you want a dedicated tool such as exiftool, which runs locally and reports essentially everything a file carries.

For removal, Acrobat has a "Sanitize document" function that strips metadata, attachments, and hidden data in one pass. exiftool can clear metadata from the command line. A cruder route that reliably discards everything: export the pages as images and rebuild the PDF from them — no original metadata survives, though you lose text selectability and the file grows considerably.

For images specifically, strip EXIF before placing them in a document rather than trying to clean up afterwards. Most phones can share photos without location data if you ask them to.

What HerePDF does with metadata

None of the other tools are sanitisers, but they don't all behave the same way. Rotate and compress open the document and save it again, so the properties it arrived with come out unchanged. Merge and split build a new file and copy the pages into it, and the document properties are not among the things copied, so the result carries none of them. That is a side effect of how the file is rebuilt, not a scrub: page-level content travels across intact, so annotations, form values and any EXIF inside embedded images are all still there. Don't treat either as a way to clean a document.

The metadata tool is built for the opposite job. It clears the document properties — title, author, subject, keywords, producing software, timestamps, and any non-standard fields an application left behind — and can strip EXIF from JPEG photos embedded in the PDF too, on by default, without recompressing the image. It does not touch XMP. The document's pointer to an XMP block can be dropped easily enough, but the block's bytes are still written into the saved file, so doing that would announce a removal that hadn't happened — the tool says the block is there and leaves it there instead. Image to PDF now strips EXIF from photos as they're added, so a PDF built entirely on this site no longer carries camera or GPS data from the start — that was a real gap before this tool existed.

For a genuine, verified scrub — one that reaches XMP as well — exiftool remains the right tool for the job.

Worth separating two ideas that sound similar. Everything here runs in your browser, so we never receive your file or its metadata — that's about who can see the document. It says nothing about what the document reveals to whoever you send it to next.