What Your PDF Metadata Reveals

The standard PDF information dictionary can contain:

• Title — the document title, often set automatically from the first heading or the source file name.
• Author — the author name, frequently pulled from the operating system user account or office software profile.
• Subject — a short description or subject line.
• Creator — the original application that produced the document (e.g. "Microsoft Word 365").
• Producer — the PDF engine that wrote the final file (e.g. "LibreOffice 7.6" or a specific library version).
• CreationDate and ModDate — timestamps for when the document was created and last modified.

None of these fields are malicious on their own, but together they can paint a picture you did not intend to share. TheAuthor field may contain a real name pulled from the creator's computer. The Creatorand Producer reveal the exact software and version used, which can be useful for targeted attacks. Timestamps can show when and how quickly a document was drafted, which is occasionally sensitive in legal or commercial contexts.

Beyond the standard dictionary, PDFs can also carryXMP metadata — an XML-based block that may include revision history, comments, tracked changes, rating tags, and even GPS coordinates from some camera or scanning apps. XMP is richer than the standard dictionary and is often overlooked.

Metadata is not the only thing a PDF can carry that is not visible on the page. A PDF can containhidden layers from OCR processing (an invisible text layer over a scanned image),attachments embedded inside the file,hidden form fields, andremoved-but-not-purged objects — content that was deleted from the page but still exists in the file because the cross-reference table was not compacted.

This last case is a quiet privacy leak. A contract draft that had a paragraph deleted before sending may still contain that paragraph in the file's object body, reachable by anyone who inspects the raw bytes. A thorough "sanitize" or "redact" step removes these orphaned objects rather than merely hiding them. Simple metadata clearing does not address this — it is a separate operation.

Most PDF readers expose the standard fields under a "Document Properties" or "Get Info" menu. XMP is harder to read without a dedicated tool, but it travels with the file just the same.

To remove metadata before sharing, you do not need to upload the file anywhere. A localedit metadata tool can clear or replace the fields in your browser, producing a clean copy without sending the document — or its metadata — over the network. This is the safest approach for sensitive documents: verify locally, then share.