PDFClean

PDF metadata: what your file reveals

A PDF looks finished when the page looks finished. Underneath, it usually still carries a record of who made it, when, on what machine, and with which software. This guide explains what is in there, how to look, and how to remove it without leaving traces.

What metadata a PDF carries

A PDF can store document properties in two places, and many files use both.

The Info dictionary holds the classic fields you see in a reader's “document properties” dialog:

  • Title — often the original filename or an internal heading.
  • Author — the person or account configured in the software.
  • Subject — a description, sometimes a project or client name.
  • Keywords — tags added by the author or the exporter.
  • Creator — the application that produced the content.
  • Producer — the engine that converted or exported it, with versions.
  • CreationDate and ModDate — timestamps, usually in the author's time zone.

It can also carry custom keys. Office suites commonly add Company; print pipelines add job or document identifiers. Those keys are easy to miss because most readers do not display them.

XMP is the newer layer: an XML packet, often several kilobytes, that duplicates the fields above and adds information such as the editing tool chain, the original document format, and when each tool touched the file. A PDF can have clean-looking Info fields and a verbose XMP packet at the same time.

Finally, the file's trailer usually holds an /ID value: a pair of identifiers for the document. It does not name a person, but it is a fingerprint that can tie two copies of a file together.

Why it leaks

Metadata is written by default, by almost every application that can export a PDF. Nobody chooses to add it; it is simply part of the export. That is why it survives the steps people take to “clean up” a document — renaming the file, deleting a page, or converting it again often keeps or refreshes the properties rather than removing them.

The practical consequences are specific:

  • An invoice exported from an office suite can name the freelancer's legal name and company even when the visible page shows only a trading name.
  • A résumé sent to a new employer can list the previous employer in the Author or Company field, and the Creator field can reveal the template it was built from.
  • Timestamps reveal working hours, time zones and the order in which versions were made. A ModDate can contradict a claimed delivery date.
  • The Producer field names the exact software and version that produced the file — useful for fingerprinting a workflow, and occasionally for matching two documents to one author.
  • XMP can retain editing history that the visible document no longer shows, including earlier titles or tool names.

None of this is exotic. It is the ordinary residue of normal document work, which is exactly why it travels unnoticed.

How to check a PDF yourself

You do not need special software to see the main fields. Common options:

  • macOS Preview: open the file, choose Tools → Show Inspector(or press ⌘I). The document properties are under the info tab.
  • Adobe Acrobat Reader: File → Properties (orCtrl/Cmd + D) shows Description and Custom fields; the raw XMP is under Additional Metadata.
  • Windows Explorer: right-click the file → Properties → Details. This shows a useful subset, not the whole picture.
  • Command line: pdfinfo file.pdf prints the Info fields;exiftool file.pdf prints Info, XMP and more. Both are free.

A reader-based check is a good start, but it usually shows only the standard Info fields. Custom keys and the XMP packet are easy to miss. A browser tool that lists everything is the more complete check — PDFClean's inspector does this without uploading the file.

How to remove metadata — and the traps

Removal sounds simple: delete the fields. In practice, several approaches leave data behind.

  • Only the standard fields are cleared. Many “remove metadata” options clear Title and Author but leave custom keys or the XMP packet untouched.
  • Re-saving adds new metadata. Saving through an editor can stamp the editor's name and a fresh ModDate into the file you just cleaned.
  • Printing to PDF is not a clean slate. It often works, but it rebuilds the document, can change fonts and links, and may add producer fields of its own.
  • Removal is not verification. A tool that says “metadata removed” has usually not read the output back. The only way to know is to parse the saved file again and look.

The last point is the reason PDFClean was built the way it is: the file is rewritten, then re-opened from its saved bytes and checked field by field. If a field survives, the check fails and the download is withheld.

A short checklist before sharing

  1. Check the file's properties before you send it — not after.
  2. Look beyond Title and Author: custom keys and XMP count.
  3. Remove with a tool that rewrites the file, not one that only hides fields.
  4. Verify the output, ideally by re-opening it and reading the properties again.
  5. Remember the limits: annotation authors, attachments and signatures are separate from document metadata.

Inspect and clean a PDFHow the verification works