What this covers
- Metadata lives outside the pages and survives page edits
- Author and producer fields frequently carry real names
- Some generators embed the original file path
- A structural rewrite clears most of it - check afterwards
Every PDF carries a small block of information about itself: a title, an author, a subject, keywords, when it was created and modified, and what software produced it.
None of that is drawn on any page. It is a separate object in the file, which is why it survives everything you do to the content and why it is the most commonly overlooked thing in a document you are about to send somewhere.
The standard fields
What each one normally contains.
| Field | Usually holds | Risk |
|---|---|---|
| Title | A document title, or the source filename | Can reveal a working title or an internal name |
| Author | The account name of whoever created it | Frequently a real full name |
| Subject | Rarely filled in | Low |
| Keywords | Rarely filled in | Low |
| Creator | The application that wrote the source document | Reveals your software stack |
| Producer | The library that wrote the PDF | Reveals the conversion route |
| CreationDate, ModDate | Timestamps, with a timezone offset | Reveals when, and roughly where |
Why redaction does not touch it
Redaction operates on page content: it removes characters from the content streams and covers the area. Metadata is not in a content stream. It is a separate dictionary, and nothing that acts on pages goes near it.
The practical consequence is a document that has been carefully redacted, checked, and sent - still carrying the author's full name in a field that any reader will display in two clicks.
Check the properties, every time
Before a document leaves your hands, open its properties and read the author, title and keywords fields. It takes ten seconds and it is the step that catches what redaction structurally cannot.
The file path leak
Some generators record more than the standard fields. A few embed the full path of the source file, which can include a user account name and a directory structure that says more about an organisation than anyone intended.
This is not exotic. It has appeared in published documents from large organisations repeatedly, and the mechanism is always the same: the export was correct, the pages were checked, and nobody looked at the parts of the file that are not pages.
XMP, the second metadata store
Alongside the classic information dictionary, a PDF can carry an XMP packet: a block of structured metadata, sometimes duplicating the standard fields and sometimes holding considerably more - editing history, tool versions, rights statements.
A tool that clears the document properties does not necessarily clear the XMP packet. This is one of the reasons that checking is worth more than trusting, and it is why a full structural rewrite is a better approach than editing fields one at a time.
Clearing metadata before sending
Five minutes, and it is the last thing you do.
- Look at what is there first
Open the document properties. You cannot decide what matters without reading it.
- Redact the page content
Names, candidate numbers and addresses in the visible text. This is a separate job from the metadata.
- Rewrite the file structurally
Most operations here rebuild the file completely, which discards incremental history and resets much of the metadata. Flatten PDF or Repair PDF both do it.
- Check the properties again
On the result, not the original. If a field survived, edit it explicitly in a reader that allows it.
- Check for annotations and form values
Both can carry text that is not obviously on the page. Flattening resolves the form values into the page; comments should be deleted if you do not want them read.
Tools involved
Metadata is also useful
It is worth saying that this is not purely a hazard. The producer field is often the fastest way to diagnose a misbehaving document, because it tells you which library wrote it - and a document with a known-quirky producer explains a lot about why text extraction is returning something strange.
The creation date tells you whether a paper you downloaded is the revision you think it is. And a document with a properly filled-in title displays sensibly in a reader's tab and in a library, which is a small courtesy to whoever receives it.
Before a document goes anywhere sensitive
- Read the document properties - author, title, keywords
- Redact identifying text on the pages
- Rewrite the file structurally to clear history and reset fields
- Re-check the properties on the result
- Check annotations and comments, which some readers hide
- Check form field values, and flatten if they should not be editable
Questions and answers
Where do I see a PDF's metadata?
In the document properties or information panel of almost any reader - usually under File, then Properties. It lists the title, author, dates and producing software.
Does redacting a PDF remove my name from the metadata?
No. Redaction removes characters from page content. Metadata is stored separately and is untouched by it. Check the properties as a separate step.
How do I clear metadata?
The most reliable way is a structural rewrite, which most processing tools perform as a side effect. Check the result afterwards, because some fields are regenerated by whatever wrote the new file.
Can metadata reveal where a document was made?
Indirectly. Timestamps carry a timezone offset, and some generators embed the source file path, which can include an account name. Neither is a location, and both are more than people expect.
