What to check in PDF metadata before sharing a document

A PDF can reveal more than the words printed on its pages. Document properties, comments and attachments deserve their own review, but not every PDF contains every kind of hidden information.

Start with a precise question

“Remove metadata” sounds like one operation, yet people use it to mean several different things. You might want to remove an author name from document properties, delete review comments, discard an embedded spreadsheet, or prevent a photograph’s original camera information from travelling with a file. These are different storage locations. Clearing the title and author fields alone cannot be assumed to address all of them.

Begin by stating what you need to achieve. For a public sample, you may want to remove the original organisation’s details. For an anonymous review, you may need to check visible text as well as properties. For a records submission, removing provenance may be inappropriate. The right operation depends on the purpose, not on a blanket assumption that all metadata is bad.

Keep an original before making changes. Metadata can be useful for searching, accessibility, attribution and document management. If you remove it from a delivery copy, retain the source record where your workflow requires it. Do not treat sanitization as an archival preservation step unless the relevant archive specifically asks for that treatment.

Common properties and where they come from

PDF document information often includes a title, author, subject, keywords, creator application, producer library and creation or modification dates. These values may come from a word processor’s user profile, a template, a conversion library or a previous version of the document. They are not necessarily accurate statements about the person who currently owns the file.

A creator value commonly identifies the application that generated source content, while a producer value may identify software that wrote the PDF representation. Dates can be copied forward, changed by a later export or expressed with a time-zone offset. An unexpected old date is a reason to investigate, not proof that the visible document is fraudulent.

Some PDFs also contain XMP metadata packets. Information can therefore exist in more than one representation. If an editor clears a simple author field but leaves an XMP author entry, another reader may still display that name. A useful inspector should show the properties it actually finds rather than presenting a fixed list of imaginary values.

PDF metadata is not the same as image EXIF

EXIF is commonly associated with images, including some camera photographs. A PDF can contain embedded image data that retains such information, but many PDFs do not. It is inaccurate to claim that every PDF contains GPS coordinates, a printer model or the operating system used to create it. Those details depend on the source files and the software that processed them.

Removing a PDF’s document information dictionary does not necessarily rewrite the bytes of every embedded image. This distinction matters when a file includes photographs taken on a phone. A tool that preserves the image data while removing document-level properties may leave information stored within that image representation untouched.

When the requirement is to discard all original embedded objects, a visual rebuild is a different option. It creates fresh page images from what the renderer displays and puts them into a new PDF. That trades document structure for a simpler representation. It also means searchable text, accessibility tags, live links and interactive fields are not preserved as they were in the source.

Inspect before choosing a mode

Open Sanitize PDF and choose the document. The inspection panel reports detected properties and counts of certain structures, such as attachments or actions. Read those findings before choosing an export mode. An empty author field does not imply that the document contains no comments, embedded files or sensitive visible content.

In the metadata-preserving-content mode, SandboxPDF removes document properties and XMP, along with supported attachments, comments, actions and related structures. It keeps visible page content and embedded image data. Supported form appearances are flattened before removing interactive structures so that visible values can remain. Inspect those values carefully in the exported copy.

Choose visual rebuild when discarding the original object structure is appropriate and an image-based reading copy is acceptable. It is the broader transformation, but it is not automatically the better choice. A recipient who needs to search a long report or use a screen reader may be poorly served by that result. Make the trade-off deliberately.

Deleting a reference is not enough

A PDF is made of objects that can refer to other objects. Removing a reference to a metadata stream can stop a reader from displaying it while leaving the old stream’s bytes in the saved file. Similarly, an attachment can become unreachable from the usual navigation panel without necessarily being removed from the physical output.

This is why a sanitization implementation needs to consider how it writes the new file, not merely which fields it clears in memory. SandboxPDF’s metadata export removes unreachable original objects before saving. Its visual rebuild avoids carrying source objects into the new document at all. Those implementation choices address a different risk from simply setting a displayed property to an empty string.

Even so, a finite metadata-cleaning routine should not be marketed as a universal forensic detector. PDFs are flexible containers, and visible page content may itself disclose the information you are trying to remove. The most reliable workflow combines a defined removal scope with a review of the final file and the surrounding delivery context.

Comments, forms and attachments can change the result

Review comments may contain names, dates or discussions that never appear in the main page text. Attachments can contain entire source documents or spreadsheets. Form fields can carry values and behaviour separate from their visible appearance. Removing these structures can improve a public delivery copy while also removing functionality a recipient expects.

For example, a form can look complete on screen but display differently if its appearance stream was never updated. Flattening needs a valid visible representation to preserve. If a cleanup operation reports that it cannot safely flatten a form, do not simply ignore the message. Review the source in a capable form editor, or choose a visual copy only if that satisfies the recipient’s needs.

Links and navigation may also disappear during broad sanitization. Check whether the reader still needs a clickable table of contents, embedded references or accessible reading order. A clean visual copy and a fully functional interactive document are different deliverables. Label them clearly when you keep both.

An anonymous review example

Suppose you are preparing a paper for an anonymous review process. Removing the author property is a sensible start, but the name may also appear in acknowledgements, a running header, a self-citation, an attachment or the filename. The appropriate edits depend on the review rules. Some processes allow certain citations and require others to be anonymised in a particular way.

Inspect the document properties, read the visible pages and check comments and attachments. Make a new delivery copy, then reopen that downloaded file. Search for your name and organisation, but also inspect image-only pages manually. Search cannot reliably identify a name printed inside a scan without a correct text layer.

Finally, check the uploaded filename and any form fields on the submission portal. A perfectly sanitized PDF can still be accompanied by identifying information elsewhere. The tool handles the document representation; the complete disclosure workflow remains a broader task.

A practical verification checklist

After export, open document properties in a separate PDF reader and check the fields you intended to remove. Inspect the attachment and comments panels. Search for known sensitive strings where searchable text remains. Confirm the page count, page sizes and orientation. Compare form values, stamps and diagrams against the original so that cleanup has not removed meaningful visible material.

For a visual rebuild, check that the output is readable at the intended scale and understand that text selection will no longer work as it did in the source. If OCR is added afterwards, use the sanitized images as input. Reusing an original text layer could reintroduce information that no longer appears visually.

If the document will be used in a formal disclosure, obtain whatever independent inspection your organisation requires. The absence of a property in one viewer is useful evidence but not a certificate of complete sanitization. Record the chosen mode and retain the original separately when required by your retention policy.

Choose the operation that matches the problem

Use property cleanup for document-level information when preserving page text matters. Use visual rebuilding when the original object structure must be discarded and the loss of interactive and searchable features is acceptable. Use Redact PDF when sensitive information is visibly present on the page. These actions overlap in some effects, but none should be used as a vague substitute for understanding the intended result.

For a fuller explanation of visible removal, read Why drawing a black box is not PDF redaction. For background on hidden PDF content, Adobe documents sanitizing PDFs. Treat external documentation as context and the actual exported file as the thing you must verify.