What your PDF says about you, and how to remove it

A CV goes out with someone else's name in the Author field, because it started life as a template a friend sent over. A document submitted anonymously carries the name of the machine that produced it. A report dated Monday was created on Thursday, and the file says so.

None of this is on the page. All of it travels with the file, and every one of these is a thing that has actually happened to people.

What a PDF actually records

More than most people would guess, and it accumulates silently as the document passes through software.

• Title, author, subject and keywords — the document properties. The author is usually whatever name your copy of Word or Acrobat was registered with, which is frequently a full legal name nobody remembers typing.
• Creator and producer — the application that wrote the document and the one that turned it into a PDF. Often two different names, and together they describe your software stack precisely.
• Creation and modification timestamps, accurate to the second, usually with your time zone attached.
• A document identifier and an instance identifier — a pair of values that link a file to earlier versions of itself.
• Application-private data. Adobe products in particular leave behind structures nobody outside Adobe documents.

The second copy almost nothing removes

Here is the part that catches people. Most modern PDFs carry an XMP packet: a block of XML embedded in the file that duplicates much of the same information and adds to it — document IDs, revision history, sometimes the full editing chain.

Clearing the document properties is easy, and it is what almost every tool does. Clearing the XMP packet is more work, so a great many tools skip it and report success. The result is worse than not having run anything: you would at least have known to check.

This is worth verifying rather than trusting. Remove PDF Metadata reads the properties, the XMP packet, the file identifiers and any private application data, and shows you all of it with where each item came from before removing anything. Run it on a file you have already cleaned elsewhere and you will often find your name still sitting in the XML.

Where this actually causes problems

Job applications

The most common real-world case. A CV built from a downloaded template, or a colleague's, keeps their name as the author. Some applicant tracking systems display document properties to recruiters.

Anything meant to be anonymous

Anonymous peer review, whistleblowing, an anonymous complaint, a blind submission. Removing your name from the page and leaving it in the properties defeats the whole exercise, and this has ended anonymity in documented cases — most famously the UK government's 2003 Iraq dossier, a Word file whose metadata still listed the last four people to have edited it, all of whom were named publicly within days. The format differs; the lesson does not.

Client and commercial work

A proposal that names your internal file path, an invoice whose producer string identifies the accounting package you use, a contract whose timestamps contradict the date printed on it. Individually small, and collectively a picture of how you work that you did not choose to send.

Documents that get published

Anything going onto a website is being downloaded by people you will never hear from, some of whom will look. Journalists check metadata as a matter of routine, and so does anyone in a dispute with you.

Metadata is not the same as content

This distinction matters and gets confused constantly. Metadata is information about the file. If your name is typed on page three, that is content, and no metadata tool will touch it — it is part of the document you meant to write.

Removing something from a page properly means redacting it, which is a different operation with its own trap: drawing a black rectangle over text leaves the text underneath, selectable and copyable. How to redact a PDF covers what actually removes it.

A sensible routine

1. 1Redact anything on the pages that should not be there, if there is any.
2. 2Read the metadata and look at what is actually in it. This takes ten seconds and is the step that tells you whether you had a problem.
3. 3Strip it, and check the result is empty.
4. 4Rename the file if the name itself says something — final-v7-after-legal-review.pdf tells a story.

Doing it in that order matters, because redaction rewrites the file and can reintroduce metadata from the tool doing the redacting.

Common questions

Does removing metadata change my document?

No. Metadata is information about the file rather than content in it, so pages, text, images and layout are untouched. The file usually gets very slightly smaller.

How do I see a PDF's metadata myself?

Most viewers show some of it under document properties, and your operating system's file details panel shows a little. Both typically show the basic properties and not the XMP packet, which is the part worth looking at. A tool that shows you everything with its source is more honest than one that shows a tidy summary.

Will stripping metadata make my file anonymous?

It removes one category of identifying information, and it is not a guarantee of anonymity. Content on the pages, writing style, embedded image EXIF, fonts unique to your system, the filename and how you send it are all separate matters. Metadata removal is a necessary step rather than a sufficient one.

Do PDFs track who opens them?

An ordinary PDF does not. A PDF can, however, contain JavaScript or references to external resources, and a document built deliberately to phone home when opened is possible. This is rare outside targeted attacks, and it is a reason to be careful with PDFs from people you do not know rather than a reason to worry about your own.

Is my file uploaded to strip it?

No. The PDF is read and rewritten inside your browser, so it works with the network switched off. Given that the entire point is privacy, sending the file to a server to have its privacy improved would be a strange trade — which is the subject of its own guide.