What your PDF is telling people, and how to check

The metadata nobody looks at

Every PDF has a document information dictionary, and most of it is filled in for you. Author is typically taken from the operating system account name, which for a great many people is their full legal name. Producer and Creator record the exact software and version that made the file. CreationDate and ModDate are timestamps, usually with a timezone offset attached — which narrows down where you were as well as when.

Individually these are trivia. Together they are a fingerprint. A document sent to a counterparty in a negotiation reveals who really wrote it, what it was written in, when it was last touched, and roughly what part of the world that happened in. Journalists have identified sources this way; litigators routinely check it; recruiters can see that a "tailored" cover letter was last modified eight months ago.

You can see all of it without special tools: open the file in almost any reader and look at document properties. It takes ten seconds and it is the single most useful habit in this article.

Redaction that does not redact

This is the failure that ends up in the news. Drawing a black rectangle over a paragraph in a PDF editor, or highlighting text in black, adds a shape on top of the page. It does not remove the text underneath. The words are still in the content stream, still selectable, and recoverable by anyone who copies the region and pastes it elsewhere — or simply opens the file in a different reader.

The same applies to cropping. Cropping a PDF page usually changes the visible box rather than discarding what falls outside it, so the cropped-away content is still present in the file and can be restored by resetting the crop. Government agencies, law firms and large companies have all published documents this way and had the "redacted" contents extracted within hours.

Real redaction removes the underlying objects, and the tools that do it properly say so explicitly. If you are not certain a tool does that, the reliable fallback is to destroy the layer entirely: print or export the page to an image, then rebuild a PDF from the images. You lose selectable text throughout, which is the cost of certainty.

What comes in with the pictures

Photographs carry their own metadata, and embedding a photo in a PDF can bring it along. EXIF data from a phone camera routinely includes the exact model, the timestamp, and — if location services were on — GPS coordinates accurate to a few metres. A scanned document is a photograph as far as the format is concerned.

The everyday case is an expenses claim, an insurance submission or a marketplace listing assembled from phone photos, where the resulting PDF quietly discloses where each shot was taken. Nobody intends this and almost nobody checks.

Strip metadata from images before they go into a document. Every image tool on this site does that by default rather than as an option you have to find, because the default that protects people should be the one that requires no decision.

Pages you meant to remove

Documents assembled from other documents inherit their history. Merging in a file and then deleting a page removes it from the page tree, but depending on how the file was written the underlying objects may survive as unreferenced data. More commonly the problem is simpler and worse: the page was never removed at all, because the sender scrolled to the end of a forty-page merge and did not notice page thirty-one.

Before sending an assembled document, open the final file and page through it — the actual file you are about to attach, not the source you built it from. Check the page count against what you expect. If pages were removed, confirm the count dropped by exactly the number you dropped.

Where a document must be provably clean, extract the pages you want into a fresh file rather than deleting the ones you do not. A new document built from selected pages contains only what you copied into it, which is a stronger guarantee than a deletion you are trusting.

How many copies already exist

Cleaning a document is worth little if six versions of the dirty one are already in circulation. The original usually sits in a downloads folder. If it was edited, the application probably wrote autosave or recovery files alongside it. If the folder syncs, a copy is in cloud storage — and most sync services keep version history, so the pre-redaction draft can often be restored months later by anyone with access to the account.

Email multiplies this further. An attachment exists in your sent items, in every recipient’s inbox, on both mail servers, and in whatever backup those servers run. Forwarding it once doubles the count again. None of that is recoverable once sent; the only version you control is the one you have not shared yet.

The practical consequence is that redaction has to happen before the first send, not after somebody notices. When a document has already gone out, the useful response is to assume the original content is public and act accordingly, rather than to send a corrected copy and hope the first one is forgotten.

The checklist

Before a PDF leaves your hands: open document properties and read the Author, Producer and dates. Select the text in any region you redacted and try to copy it. Reset any crop and look at what reappears. Confirm the page count. Check whether embedded photos still carry EXIF. And ask whether the file needs to travel through anyone else’s server to get where it is going.

That last one is the reason this site exists. Every check above is undermined if the document is uploaded to a third party in order to be cleaned, because you have now created a copy of the unclean version somewhere you cannot audit. Doing the work locally means the only copy that ever existed is the one on your own disk.

Questions