What this covers
- The author field usually contains a real name, taken from the account
- Timestamps carry a timezone offset
- Some generators embed the full source file path
- Editing a PDF can leave earlier versions inside it
A PDF is a container, and it carries more than the pages. Most of what it carries is harmless and some of it is useful. A small amount of it is information you would not have chosen to send, and none of it is visible when you look at the document.
What is in there
Everything below is present in ordinary documents produced by ordinary software.
| Item | Typically contains | How exposed |
|---|---|---|
| Author | Your operating system account's full name | Displayed in any reader's properties panel |
| Creator | The application you wrote the document in | Same |
| Producer | The library that wrote the PDF | Same |
| Creation and modification dates | Timestamps with a timezone offset | Same |
| Title | Often the source filename, including a working title | Same, and shown in the browser tab |
| Source file path | Sometimes the full path including your account name | Requires looking, but not much |
| Annotations | Comments, including ones you thought you deleted | Hidden by default in some readers |
| Form field values | Whatever was typed, even if not visible | Extractable |
| Incremental history | Earlier versions of edited content | Recoverable from the raw file |
The author field
Most software fills this automatically from your operating system account, which on a personal machine is usually your real full name. It is the most commonly overlooked disclosure in a document, because nothing on any page shows it and nobody thinks to look.
On an anonymous submission this matters directly. A script carefully written without a name, submitted through an anonymous marking system, carrying the candidate's full name in a field the marker's reader displays in the title bar, is not an anonymous submission.
Ten seconds, before anything leaves
Open the document properties and read the author, title and keywords fields. That is the whole check, and it catches the disclosure that redaction structurally cannot.
The file path
A few generators record the full path of the source document. That is a string like a user directory, a folder structure and a filename, and between them they can reveal an account name, an organisational structure and a working title nobody intended to publish.
This is not a hypothetical. It has appeared in published documents from large institutions repeatedly, and the mechanism is always the same: the export was correct, the pages were reviewed, and nobody examined the parts of the file that are not pages.
Incremental saving
A PDF can be updated by appending changes rather than rewriting, with a new index pointing at the changed objects. The old objects stay in the file.
A document edited this way can contain earlier versions of its own content - including, in the worst case, text that was subsequently removed. Anyone reading the raw file rather than the rendered pages can recover it.
The fix is a full rewrite, which most processing tools perform as a side effect. It is a good reason to run anything sensitive through one final operation before sending it.
Annotations and form values
A comment attached to a page is an object, not page content. Some readers hide annotations by default, so a document can carry comments the sender has forgotten and the recipient can see with one setting.
Form fields are the same. A field whose value is not visible in the layout still holds that value, and extracting the document's data returns it. Flattening resolves field values into the page, which makes them visible - and therefore reviewable - rather than hidden.
Cleaning a document before sharing
Five minutes, as the last step.
- Read the properties first
You cannot decide what matters without seeing it.
- Delete annotations you do not want read
Turn annotation display on in your reader first, so you can see what is there.
- Flatten any form fields
Values become page content, visible and reviewable.
- Redact identifying text on the pages
Names, numbers, addresses. A separate job from the metadata.
- Rewrite the file structurally
Discards incremental history and resets much of the metadata.
- Check the properties on the result
Not on the original. Some fields are regenerated by whatever wrote the new file.
The sequence in tools
Two documents, same visible content
The difference is everything that is not a page.
Not cleaned
- Author field carrying a full name
- Title holding an internal working name
- Three comments the sender forgot about
- A form field with an earlier answer in it
- Two previous versions recoverable from the raw file
Cleaned
- Metadata fields reviewed and reset
- Annotations deleted deliberately
- Form values flattened into the page
- Identifying text redacted and verified
- File structurally rewritten, history discarded
Before sharing anything that matters
- Document properties read, not assumed
- Annotation display turned on and comments reviewed
- Form fields flattened
- Page text redacted and the redaction verified
- File structurally rewritten
- Properties checked again on the result
Questions and answers
How do I see what metadata my PDF carries?
Open the document properties in almost any reader - usually File, then Properties. It lists the author, title, dates and producing software.
Does my PDF contain my location?
Not directly. Timestamps carry a timezone offset, which narrows it considerably, and a few generators embed a file path that can include an account name. Neither is a location and both are more than people expect.
Are deleted comments really still in the file?
They can be, if the document was saved incrementally. The deletion appends a change; the original object remains. A full rewrite discards it.
Is this a reason not to share PDFs?
No - it is a reason to spend ten seconds on the properties panel. The checks above take five minutes in total and cover everything described here.
