You send a PDF to a client, a regulator or a competitor, and what they receive is more than the pages you meant to share. Tucked into the file may be the name of the person who wrote it, the folder it was saved in, an earlier draft, review comments, a spreadsheet attached to it, or a script. This guide sets out what a PDF can carry beyond its pages, the cases where it has caused embarrassment, and how to strip it all before you hit send.
More than the pages
A PDF is a container. The pages are the part you see, but the file around them records how it was made and what has happened to it since. Much of that is useful for the author and irrelevant to the reader, and almost none of it is shown unless someone goes looking. That is exactly the problem: the author forgets it exists, and the recipient can read it in two clicks.
Hidden data is rarely sinister. It is a by-product of tools doing their job. But it is easy to leak, because the person who has to clean it is the person who can’t see it.
Think about how a typical file is made. Someone drafts a report in a word processor, a colleague adds comments, a third person exports it to PDF, and a fourth combines it with an appendix. Each step can add something: an author field, a comment, a script, an attachment. By the time the file is ready to send, nobody remembers which steps were taken, and nobody owns the question of what the file now contains. Cleaning it deliberately, as the last step, is the only way to be sure.
What a PDF can carry
| Item | What it can reveal | Risk |
|---|---|---|
| Document properties | Title, author, subject, keywords, the program used and its version, creation and modification dates | Names the author and the software, and shows when you worked on it |
| XMP metadata | A second copy of the above, plus extra fields from the creating program, sometimes including file paths | Repeats what you cleared from the first copy |
| Attached files | Spreadsheets, source documents or images embedded in the PDF | Whole files travelling unseen |
| JavaScript | Scripts that run when the file opens or a field changes | Security risk, and some readers warn about it |
| Hidden layers | Content in layers switched off by default, such as drafts and notes | Anyone can switch the layer on |
| Comments and annotations | Review notes, highlights, drawings and the names of the reviewers | Candid comments sent to the wrong side |
| Links | Web addresses, email addresses and links to internal pages | Can expose internal addresses or tracking parameters |
| Earlier versions | Some programs append changes instead of rewriting, leaving the old page content in the file | Text you deleted may still be present |
| Embedded images | Photos can carry their own camera and location data | Shows where and with what a photo was taken |
When hidden data caused trouble
The pattern is old and it keeps repeating, sometimes with the word processor documents that PDFs are made from.
- The 2003 Iraq dossier. The UK government published a briefing paper on Iraq as a word processor file. A researcher examined its properties and revision history, which named the officials who had worked on it and showed it had been edited by several staff. The finding made the news, and it is a standing lesson to export clean files.
- Anonymous peer review. Journals ask authors to remove their names from a manuscript, and the name still turns up in the file’s author field. Reviewers who check the properties can see who wrote it.
- Redactions that were only covers. Court filings and government reports have repeatedly been published with passages blacked out but still readable, because the text under the bars was never deleted. We cover those cases in how to redact a PDF properly.
None of these needed special tools. They needed a reader, a properties window and a few minutes of curiosity.
How to look inside your own file
You can do a rough check with any reader, before you strip anything:
- Document properties. Open the file and find Properties in the File menu. Read the title, author, subject, keywords, application and dates.
- The comments panel. If it shows anything, those comments are in the file.
- The attachments panel. Many readers have a paperclip or an Attachments tab. If you see files, they’re embedded.
- The layers panel. If it exists, the file has layers. Try switching them all on.
Our Remove metadata tool does the same, in one place. Open a file and it scans it on your device, then lists how many of each kind of item it found, with the details expandable. Nothing is uploaded to do it.
What to strip, and when
Not every file needs everything removed. A rough guide:
| Where the file is going | Strip | Think about |
|---|---|---|
| A client or customer | Properties, attachments, JavaScript, hidden layers, comments | Keep links if they need to click through |
| A regulator, court or journalist | Everything, including links | Redact visible content separately |
| An anonymous review or competition | Properties and the XMP packet at the least | Check the pages, headers and file name for names |
| A colleague for further work | Possibly nothing | Comments may be exactly what they need |
| A public website | Properties, attachments, JavaScript, hidden layers, comments | Compress and set a clear title |
Stripping it step by step
- Finish the document first. Do your editing, merging, watermarking and compressing before you clean it, because those steps can write new metadata.
- Open it in Remove metadata. Drop the file into Remove metadata. It scans the file and shows what it found.
- Tick what to remove. Properties, attachments, JavaScript, hidden layers and comments are on by default. Links are off, because removing them breaks clickable contents pages and references.
- Clean and read the report. After cleaning, a report shows what was found and what was removed, so you know the job is done.
- Check the result. Open the clean file in your reader and look at its properties. The fields should be empty.
- Protect it if needed. If the file must stay private in transit, add a password with Protect PDF, and send the password by a different route.
The clean copy is written from scratch instead of being edited in place, so earlier saved versions inside the file are not carried across. Pages, text and pictures look exactly the same.
What stripping does not cover
Cleaning removes what is hidden. It does not touch what is visible, and it doesn’t reach inside every object:
- Visible text and images. A name in the body of the document stays. To remove it for good, use Redact PDF.
- Data inside embedded photos. A photo placed in the PDF may carry its own camera or location details in its image data. Strip photos before you insert them if that matters.
- The file name. “Smith-v-Jones-settlement-offer-v3.pdf” says plenty. Rename it.
- Information in the text itself. Headers, footers, captions and signatures can name people. Read the document as a stranger would.
Order matters. Redact visible content first, then strip hidden data, then compress or protect. Do it in that order and the later steps cannot undo the earlier ones.
A checklist before you send
- Does the file name give anything away?
- Are the document properties empty or deliberate?
- Are there comments, attachments or hidden layers left in?
- Is anything in the visible text that the recipient should not see?
- If the file is sensitive, is it password-protected, with the password sent separately?
- Have you opened the finished file, not the one you worked on?
Frequently asked questions
What is PDF metadata?
It is information about the file instead of on its pages: title, author, subject, keywords, the program that created it and the dates it was made and changed. It is stored in the document properties and often repeated in an XMP packet.
How do I see the metadata in a PDF?
Open the file in any reader and look for Document Properties or File, then Properties. It shows the title, author, dates and the program that produced the file. Remove metadata also shows what it finds when you open a file.
Does removing metadata change how the document looks?
No. The pages, text and images stay the same. Only things you can’t see on the page, plus comments, links and hidden layers if you choose to remove them, are affected.
Can a PDF contain a virus or a script?
A PDF can carry JavaScript and attachments, and malicious files have used them. Most documents need neither, so removing them before sharing makes the file safer to open.
Is hidden data the same as a password-protected file?
No. A password controls who can open the file. Hidden data is what the file contains for everyone who can open it. Clean it first, then protect it if it needs to stay private.
Does converting a PDF to images remove all hidden data?
Largely, because the new file contains only pictures of the pages. It also removes the searchable text, makes the file larger and loses links, so cleaning the file is usually the better choice.