Removing Hidden Data from a PDF: Comments, Attachments, Scripts and What Stays

A PDF you have finished reviewing can still carry the reviewer's comments, a spreadsheet attached to the report, a script that runs when the file opens, and a small preview image of a page from before it was edited. None of that shows on the page. All of it goes out with the file when you send it.

What a PDF carries beyond its pages

• Comments and markup - notes, highlights, underlines, shapes and text boxes, often with the commenter's name and their words about the document.
• Attached files - whole files embedded inside the PDF, and the file-attachment notes that point at them.
• Scripts - JavaScript that runs when the file opens, when a page is shown, or when a field changes.
• Thumbnails and app data - preview images of pages, which can show a page as it looked before an edit, and private data some programs leave in the file.
• Document properties - the author, title and other fields, plus the XMP block. The metadata tool covers these on their own.
• Form answers - what someone typed into the fields, which may be hidden behind a blank-looking form.

Look before you remove

The remove hidden data tool reads the file first and lists each kind with a count, so you see what is there before anything changes. Each kind is ticked only if the file has something of that kind, except form answers, which are unticked by default. The list also names what the tool leaves alone: links, optional-content layers and digital signatures. A link that is removed stops working, and a signature that is removed is invalidated, so both are kept.

What removal means

Removing an item is not the same as hiding it. A comment that is switched off but still in the file can be switched back on by anyone with a reader. The tool deletes each item it removes, then rewrites the file without the objects nothing refers to any more, so the content is gone from the saved file itself. You can check this with any tool that opens the raw file. Form answers are removed the same way: the typed value and the drawn answer go, and the field stays so it can be filled in again.

Before you tick the boxes

Three things need a decision before you download. Scripts stop calculations and buttons working, so a form that depends on them should keep them, or be sent as a flattened copy instead. A comment can quote the text it was written about: the note goes, but the words on the page under the highlight stay. And a digitally signed file is rewritten by any change, which invalidates its signature. If the signature matters, keep the signed original and work on a copy.

What this does not do

The tool looks for data the file declares as hidden. It does not look at what is drawn on the page. Text in white ink, text under an image, content outside the visible crop, and anything inside a picture are page content, and they stay. A name printed on page four is still there after the tool runs. For that, use the redact tool, which renders the marked pages and rebuilds them from the result. The guide to redaction explains why a black box drawn over text is not enough.

A sensible order

Start by reading the counts. Clear what you do not need to send, and keep the original. If the document is going to be locked for review rather than edited, flatten it after removing the comments you no longer want, using the flatten tool, which is covered in flattening a PDF. Last, check the result by opening it in a different reader, since a second look at the file often finds something the first pass missed. The five-minute checklist before you send a PDF puts this step in order with the others.

Everything runs in your browser. The file is read and rewritten on your device, and the cleaned copy is downloaded from there. Nothing is sent to a server.