What Hidden Data Your PDF Carries When You Send It
You read a document before sending it. You check the pages, the numbers, the spelling.
You are checking the part that is visible. A PDF also carries a quantity of information that is not on any page — who made it, with what, when, what it used to say, and occasionally where a photograph inside it was taken. None of that appears when you scroll through, and all of it travels with the file.
Most of the time this is harmless. The times it is not tend to be the times that matter: a tender submitted to a competitor’s client, a document sent to the other side of a dispute, a report published on a website.
What is actually in there
Document properties. Title, author, subject, keywords, and the names of the software that created and produced the file. The author field is the one that catches people, because software usually fills it in automatically from your computer account — which is frequently your real full name, or a corporate username that maps directly to you.
Timestamps. Creation and modification dates, showing when the document was made and last touched. A document dated three weeks before you claimed to have written it is a conversation you do not want.
The producing software, down to version numbers. Rarely sensitive on its own; occasionally revealing about an organisation’s systems.
Annotations and comments. Sticky notes, highlights, and review markup are objects in the file. A reader that does not display a comments pane does not delete the comments — it just does not show them.
Form field values, which persist as data even where a reader is not drawing them on the page — the same mechanism behind a form that will not save what you typed.
Attachments. PDF supports embedding whole files inside a document. A spreadsheet attached during review is still there.
Edit history. The format allows a document to be saved by appending changes to the end rather than rewriting the file. A document edited twenty times may carry twenty rounds of state, including content since removed.
Metadata inside embedded images. This is the one people never think of. A photograph placed into a document usually carries its own EXIF data — camera, timestamp, and on phone photographs, often GPS coordinates. Putting the photo into a PDF does not strip that.
The filename. Not inside the file at all, and still the first thing your recipient reads. final-offer-v3-dont-send-to-client.pdf has told the story before anyone opens anything.
How to look
Every serious reader exposes the basics under File → Properties or Document Properties. You get title, author, subject, keywords, creation and modification dates, and the producing application.
Read the author field first. It is the one most likely to contain a name you did not intend to publish.
Be aware that this panel shows the tidy summary and not everything. Attachments usually have their own pane; annotations appear in a comments pane; EXIF inside embedded images is not surfaced by any PDF reader. Properties tells you whether there is an obvious problem, not whether there is no problem.
What rebuilding the document removes
Every operation on this site builds a new document and copies the pages you kept into it. A useful consequence of that design is that document properties do not come along.
Tested directly — a document carrying title, author, subject, and creator, then rebuilt the way these tools rebuild:
| field | before | after rebuild |
|---|---|---|
| Title | Q3 Redundancy List CONFIDENTIAL | (empty) |
| Author | r.ayyadah | (empty) |
| Subject | internal only | (empty) |
| Creator | SecretCorp Editor | the PDF library’s name |
So running a document through Organize PDF, or any other operation here, drops the document-info fields. Merging, splitting, extracting, and rotating all do this, because they all rebuild.
Be clear about what this is. It is a side effect of how these tools work, not a metadata-removal feature, and it is not a guarantee to lean on for anything sensitive. It removes the document properties. It does not claim to remove everything, and the next section is the honest limit of it.
What rebuilding does not remove
- EXIF inside embedded images. The image is copied as an image, and whatever it carries comes with it. GPS coordinates in a phone photograph survive.
- Anything visible on a page you kept. Rebuilding is not redaction.
- Attachments and annotations, depending on the operation.
And two habits that specifically do not remove anything, however much they look like they do:
Cropping hides, it does not delete. Content outside a crop box remains in the file and returns the moment someone widens the crop — how to crop PDF margins.
A black rectangle drawn over text is a rectangle drawn over text. The words underneath stay selectable and copyable. This is the single most damaging misconception in this whole area, and it has embarrassed organisations that should have known better.
If something must not reach the recipient, remove the entire page — how to remove pages from a PDF. That is a real operation. No tool on this site claims to redact, and none of them do.
The nuclear option, and its price
If a document is sensitive enough that you want certainty rather than a checklist, there is one approach that leaves almost nothing behind: turn the pages into pictures.
Rendering each page as an image discards everything that was not visible. No text layer, so no invisible text. No annotations, because they are not drawn as objects any more. No form fields. What survives is exactly what your eyes could see, plus whatever the images themselves carry.
Compress PDF does this, since re-encoding pages as images is what compression here means. The cost is severe and worth stating plainly:
- The text stops being text — no search, no selection, no copying. See why can’t I copy text from a PDF.
- Screen readers get nothing at all, which can make a document unusable for someone who needs one.
- The file usually gets larger, because photographs of characters cost far more than characters — the arithmetic is in why is my PDF so large.
- It cannot be undone.
And it still does not redact. Anything visible on the page is now permanently visible, baked into an image. This removes the hidden layers; it does nothing about what is printed on the sheet.
Use it when the document is short, final, and genuinely sensitive. Do not use it as routine hygiene.
Before you send anything that matters
A short routine, under two minutes:
- Check Document Properties. Look at author, title, and subject specifically.
- Look for a comments pane. Review markup you have stopped seeing is still there.
- Check for attachments.
- Consider where the images came from. Anything photographed on a phone may carry coordinates — strip that before placing it in the document, not after.
- Read the filename as a stranger would.
- Re-export from the source if the document has been through many revisions, which produces a clean file without accumulated history.
Step 6 is the most thorough answer available and the least convenient. When a document is genuinely sensitive, it is the right one.
Where this matters most
The routine above is overkill for a menu and proportionate for these:
- Tenders and bids, where the recipient may be evaluating you against competitors.
- Anything going to the opposing side of a negotiation or dispute.
- Documents published on a website, which are permanent and indexable.
- Whistleblowing, journalism, or anything where a source needs protecting — the author field alone has identified people.
- Photographs of property or people, where coordinates are a genuine safety question rather than a theoretical one.
The common thread is that the recipient is not simply going to read it.
Do this on your own machine
There is an obvious irony in uploading a confidential document to a stranger’s server in order to remove the confidential information from it.
Everything here runs in your browser: the file is read from your disk, rebuilt in memory, and written back. It is not transmitted, and the mechanism that enforces that — rather than merely promising it — is described in how browser-based PDF processing protects your privacy.
Why the format works this way
The document information dictionary and the XMP metadata stream are both part of ISO 32000-2, as is incremental saving, which is what allows a file to accumulate its own history. The PDF Association publishes accessible reference material on that structure.
None of this is a flaw. Metadata is genuinely useful — it is how document management systems index, how archives establish provenance, and how PDF/A supports long-term preservation. The problem is not that the information exists. It is that it is created automatically, carried invisibly, and read by anyone who thinks to look.
Knowing it is there is most of the defence.