What's hidden in your PDF: metadata explained
You send a quote to a new client. The document looks clean and professional. But if they open File → Properties, they may see the name of the last client you sent it to, the template you reuse for everyone, the fact that you exported it at 2:14 a.m., and a file path containing your full name. You didn't type any of that. Your software added it for you, and it travelled with the file.
What metadata actually is
A PDF is a container. Alongside the pages you can see, it carries structured information about the document. Some of it is genuinely useful — a title for the window bar, a language hint for screen readers. Most of it is added automatically by whatever program produced the file, without asking you, and it stays there for the life of the document.
This isn't a defect and it isn't malicious. It's a side effect of how document tools work. The problem is simply that almost nobody looks, so the data gets sent along with the file to people who were never meant to see it.
The three places it hides
This is the part most explanations skip, and it's the reason "I cleared the author field" often isn't enough. PDF metadata lives in at least three separate layers, and clearing one does not clear the others.
- 1. The document information dictionary. The classic set of fields:
Title,Author,Subject,Keywords,Creator,Producer,CreationDate,ModDate. This is what your PDF reader shows under Properties. It's the layer people know about. - 2. XMP metadata. A separate XML packet embedded in the file, from Adobe's Extensible Metadata Platform. It frequently duplicates the document info fields — which means a tool that clears one and not the other leaves your name sitting in the file in a place the Properties dialog doesn't show. XMP can also carry editing history, rights statements, and application-specific records.
- 3. Metadata inside embedded images. If your PDF contains photos or scans, each embedded image can carry its own EXIF block: camera or phone model, capture timestamp, and — on photos taken with location services enabled — GPS coordinates. Stripping the PDF's own fields does nothing to the EXIF sitting inside a JPEG three layers down.
What actually leaks in practice
In real documents, the recurring offenders are boringly consistent:
- Your name, or someone else's. The
Authorfield usually inherits from the account that installed the software — often a personal name on a document meant to come from a company. When a template gets reused, it can carry a previous client's details. - Your software and its version.
Creatorrecords the originating application;Producerrecords the library that actually wrote the PDF. Together they advertise your toolchain, which is minor on its own and genuinely useful to someone probing for known vulnerabilities. - File paths. Some exporters write the source path into the file.
/Users/firstname.lastname/Clients/Acme/Drafts/discloses your real name, your folder structure and sometimes your customer list, all from one field. - Timestamps.
CreationDateandModDaterecord when the document was made and last touched. Awkward when a document was supposedly finished last week, or when it shows you drafted a resignation letter on company time. - Earlier versions of the document. The PDF format supports incremental updates: changes can be appended to a file while the previous content remains in the bytes above. A document edited and re-saved may still contain what it said before.
That last one deserves emphasis, because it's the mechanism behind a whole category of public embarrassments — documents published with edits that were never really removed, only superseded.
How to see what's in your own file
Don't guess. Look. You can inspect a PDF's metadata without sending it anywhere:
- Open the Metadata Audit tool. Go to Metadata Audit. It runs in your browser — the document is read on your device rather than uploaded to be analysed.
- Choose the PDF you're about to send. Ideally the exact file, not an earlier draft — the fields you care about are written at export time.
- Read the report. Look for anything you wouldn't say out loud to the recipient: a personal name, a path, a previous client, a timestamp that contradicts your story.
- Decide what matters. A title is harmless. Your home directory isn't.
How to remove it
Once you know what's there, stripping it is quick:
- Open the Remove Metadata tool. Go to Remove Metadata.
- Load the finished PDF. Do this last, after every other edit. Any tool that rewrites the file afterwards will stamp fresh metadata back in.
- Export the cleaned copy. You get a new file with the identifying fields cleared.
- Verify. Run the cleaned file back through Metadata Audit. Trust the report, not the intention.
What removing metadata does not do
This is where people get a false sense of security, so it's worth being blunt about the limits.
- It doesn't redact anything you can see. Metadata removal touches the data about the document, not the document. Sensitive text on page 3 is still on page 3.
- It doesn't fix a black box drawn over text. A rectangle drawn on top of words is a graphic sitting above them; the text underneath is still selectable, still copyable, still there. Removing metadata changes nothing about that. Real redaction has to remove the content itself, not cover it.
- It doesn't anonymise writing. Your letterhead, your phrasing and the client name in paragraph one are all still yours.
- It isn't permanent going forward. The next tool that touches the file writes its own
Producerand a freshModDate. Clean last, then send.
When this actually matters
Not every document needs sanitising, and pretending otherwise is just noise. For a menu or a newsletter, metadata is irrelevant. It starts to matter when a document crosses a boundary between people who don't share all the same information:
- Anything sent to a competitor's world — proposals, tenders, quotes. Reused templates leak previous recipients.
- Anything published. Once a file is on a website it can be downloaded and inspected by anyone, forever, at their leisure.
- Anything involving photos or scans, because of the EXIF layer. A scanned document photographed at home can carry the coordinates of your home.
- Anything where you're deliberately anonymous — whistleblowing, sensitive reporting, a complaint. Here the
Authorfield can undo the entire exercise.
A reasonable habit: audit anything that leaves your organisation, strip anything that gets published, and don't lose sleep over the rest.
Why do this on your own device?
There's an obvious irony in uploading a confidential document to a stranger's server in order to find out what confidential information it contains. If the reason you're checking is that the file is sensitive, then handing a full copy to a third party — with whatever retention and logging they happen to practise — has already conceded the point before you've read the report. Inspecting and cleaning the file where it already lives avoids that trade entirely. In CyvoDocOps, supported operations of this kind run locally in your browser and the document is not uploaded to a server.
Frequently asked questions
Does removing metadata change how my PDF looks?
No. The visible pages are untouched. You're clearing information stored about the document, not the document's content.
Can I remove metadata from a PDF someone else sent me?
Yes, if you can open the file. Cleaning it changes your copy — it has no effect on the original the sender still holds.
Why does the author field show a name I've never heard of?
Almost always a reused template or a shared machine: the field was inherited from whoever created the original document and was never updated.
Is metadata the same as a digital signature?
No. Metadata is descriptive information about the file. A signature is a cryptographic claim about its integrity and origin. Stripping metadata from a signed document can invalidate the signature — clean first, sign last.
Do my files get uploaded to check them?
No. For these tools the PDF is processed locally in your browser and is not sent to a server.