What your PDF reveals about you: metadata, history and hidden layers

Before you send that PDF, it’s worth knowing what you’re actually sending. Beyond the visible pages, a typical PDF carries a small dossier about its own creation — and occasionally about its earlier drafts. None of it is malicious; all of it is worth two minutes of your attention when the document matters.

The metadata you can see in any viewer

Open a PDF’s properties dialog (File → Properties in most viewers) and you’ll usually find:

• Author — very often a real name, harvested automatically from the operating-system or Office account of whoever created the file. People anonymizing a document’s content routinely forget its author field. Landlord references, complaint letters, anonymous reports: the classic leak.
• Title, subject, keywords — sometimes revealing in themselves (Draft v7 — DO NOT SEND, or the title of the template the document was built from).
• Creator and producer — the software used (Microsoft Word, Adobe InDesign 19.2), with version numbers.
• Creation and modification dates — which can contradict a document’s story. A “signed on March 1st” agreement whose file was created March 14th invites questions. Timestamps may also carry timezone offsets.

There’s frequently a second copy of all this in XMP — an XML metadata block embedded in the file — which can disagree with the visible properties: XMP sometimes preserves details from an original document that the visible fields no longer show, including the editing history trail left by some workflows.

The subtler leaks

Incremental saves. Some editors append changes to the end of a PDF instead of rewriting it. The file accumulates layers: earlier versions of edited text, and sometimes content the author believes deleted, can remain in the file — recoverable with the right tools. If a document went through many rounds of editing in such a tool, the bytes may remember rounds you’d rather they didn’t. A clean rebuild of the file discards this history.

Unflattened form fields. A form field displays its current value, but the field structure travels with the file — and fields can be edited by any recipient. Related and worse: form data occasionally survives in the file even where the visible layout has moved on. Flattening paints current values into the page and removes the field layer.

Fake redaction. The famous one. Black rectangles drawn over text in a word processor or annotation tool do not remove the text — it sits under the box, selectable with Ctrl+A or extractable by any text tool. Courts have seen this exact failure in high-profile filings repeatedly. Redaction requires a purpose-built redaction feature that removes the underlying content — and federal court guidance warns about this explicitly.

File names. Not metadata inside the file, but sent along with it: Smith_settlement_counteroffer_FINAL_v3.pdf says plenty. Rename before sending.

How to check what your PDF is carrying

1. Properties dialog — thirty seconds, catches the author-name and dates leaks.
2. Select-all test — Ctrl+A, Ctrl+C, paste into a text editor. Whatever pastes is extractable text, including anything “hidden” under drawn boxes.
3. Click the form areas — if boxes highlight and accept input, the field layer is live.

How to strip it

For everyday purposes, stripping the metadata layer is one pass:

• Our compressor removes the document information dictionary and XMP metadata by default while it works (there’s a checkbox to keep them) — and because the whole operation runs in your browser, the document you’re cleaning doesn’t take a trip through someone’s server on the way to becoming “private”. The rebuild also discards incremental-save history.
• Desktop tools: Adobe Acrobat’s “Remove Hidden Information”, LibreOffice’s export options, or exiftool/qpdf on the command line do equivalent jobs.

What stripping does not do: it doesn’t redact page content, it doesn’t remove text under black boxes, and it doesn’t flatten forms. Those are separate, deliberate steps — see above.

A sensible pre-send checklist for sensitive documents

1. Check the properties dialog; note what the author field says.
2. If the document needs redaction, redact with a real redaction tool — then verify with the select-all test.
3. Flatten filled forms.
4. Strip metadata (the compressor does it as a side effect, and usually shrinks the file too).
5. Rename the file to something you’d be comfortable reading in a mail header.

Perspective

Most PDFs don’t need any of this. A recipe, an invoice, a manual — nobody cares which Word version made them. The point isn’t paranoia; it’s that for the documents where it matters — legal, medical, financial, anything anonymous — the leaks are systematic, silent, and two minutes’ work to close. Knowing which two minutes is the whole trick.