Document privacy guide
What Metadata Is Hidden in a PDF?
By Laramie Williamson ·
A PDF is a container, not a flat picture of a page. Alongside the visible content it keeps document properties in two separate places, plus annotations, form field values, embedded files, and sometimes earlier versions of the document itself.
Two sets of properties, not one
The older mechanism is the document Information dictionary: Title, Author, Subject, Keywords, Creator, Producer, CreationDate and ModDate. The newer one is an XMP packet — an XML block embedded in the file — which usually duplicates those fields and adds a document ID and an edit history.
Because the two are stored independently, tools that clear only the Info dictionary leave the XMP copy behind, and the author name reappears in any reader that prefers XMP. When you check your own file, confirm both are gone rather than assuming one result covers the other.
- Producer often names the exact software and version that wrote the file.
- Creator often names the original authoring application, which can reveal an internal toolchain.
- CreationDate and ModDate are usually precise to the second, with a timezone offset.
A black box over text is not redaction
This is the mistake that leaks documents. Drawing a filled rectangle in a PDF editor adds a shape on top of the page; the characters underneath stay in the content stream. Anyone can select the region and copy the text out, or extract it programmatically in seconds.
Real redaction removes the underlying content, not just the view of it. If a passage must be unrecoverable, remove it in the source document and re-export the PDF, or use software that specifically applies redactions and then flattens the file. Treat any "covered" text as still present until you have verified otherwise by extracting the text.
Annotations, form values, and attachments
Comments, sticky notes, and highlights are separate annotation objects attached to a page, each usually carrying its own author name and timestamp. Filled form fields keep their values in the field objects, so a form that looks blank on screen can still hold what someone typed. PDFs can also carry embedded files — a spreadsheet attached to a report is a common one — and those are easy to miss because nothing on the page announces them.
Inspect each of these as its own category. On FreeProTool the extract tools show you what is present before you decide anything: extracting the text of a PDF is the fastest way to prove whether "redacted" content is really gone.
What the browser tool does and does not do
FreeProTool's PDF metadata cleanup deletes the Info dictionary and the XMP metadata stream from the file locally, then rescans the output and reports any fields that survived. Image removal deletes embedded image objects outright, though images drawn inline inside a page's content stream are a separate case and are not touched.
Link, email, and comment removal for PDFs is inspection-only for now — the tools find and export what is there rather than rewriting the file. That is a deliberate limit worth knowing about: for those categories, use the report to decide what to fix in the source document.
Apply this to your file
When you are ready to work on the asset, use FreeProTool to inspect and remove PDF metadata.
Tools for this task
Related guides
Find and strip the author names, edit time, company fields, and comments that a .docx carries after Save As, and understand what Word's own cleanup misses.
A short pre-send checklist for PDF, Word, Excel, and PowerPoint files: what to look at, in what order, and which checks people usually skip.