Open the document properties of a PDF you did not create. There is a reasonable chance you will learn the name of the person who wrote it, the organisation they work for, which software they used, what the file was originally called, and when they last edited it — none of which appears anywhere on the visible page.
Now consider that every PDF you have ever sent carries the same layer.
Most of the time this is harmless. Occasionally it is not: a job applicant whose CV names the template's original owner, a law firm whose filing reveals internal file paths, an anonymous submission signed by its author in the document info dictionary.
Where the information lives
PDF metadata is not a single field. It is scattered across several places, which is why "I cleared the author field" usually is not enough.
The document information dictionary. The classic set, visible in nearly every viewer under File → Properties: Title, Author, Subject, Keywords, Creator, Producer, CreationDate, ModDate.
Two of those deserve attention. Creator records the application the content originated in — Microsoft Word, InDesign, LaTeX. Producer records what converted it to PDF — Distiller, a print driver, a library. Together they fingerprint your toolchain fairly precisely, often down to version numbers.
Author is the one that catches people, because it is usually populated automatically from your operating system account name. If your laptop user is sarah.mitchell, that is what ships.
XMP packets. A parallel metadata system, stored as embedded XML. XMP frequently duplicates the info dictionary, which is why clearing one and not the other leaves the data intact. It can also carry considerably more: edit history, document IDs that persist across saves, rights statements, and application-specific blocks.
Form field values. A PDF form remembers what was typed into it. If a form was filled, cleared visually, and reused, the underlying field values can survive.
Annotations and comments. Review comments carry author names and timestamps. Deleting the visible markup does not always remove the underlying annotation objects.
Incremental update history. This is the least understood and the most dangerous. The PDF format supports saving changes by appending to the file rather than rewriting it. Each save adds a new section while leaving the previous state in place. A document edited many times can contain several earlier versions, recoverable by anyone who parses the file structure rather than just viewing the current page.
If a file has been through many rounds of edits and is much larger than its content justifies, appended history is a likely reason.
Content outside the crop box. A PDF page has a MediaBox (the full page) and often a CropBox (the visible region). Cropping a PDF usually just shrinks the CropBox. The content outside it is still in the file — hidden, not deleted. Anyone can widen the crop box and see what was trimmed away.
This is a genuine limitation of how cropping works, including in our own Crop PDF tool. If you are cropping for tidiness, it is fine. If you are cropping to remove something sensitive, it is the wrong tool — that is a redaction job, and we wrote about why covering things up fails separately.
Embedded fonts and attachments. Fonts can reveal what was installed on the authoring machine. PDFs can also carry arbitrary file attachments, which some workflows add without the author noticing.
How to look
Before worrying about a document, find out what is actually in it.
Any PDF viewer. File → Properties, or Ctrl+D in Acrobat. Shows the info dictionary. Fast, and catches the most common exposure.
ExifTool. The thorough option. exiftool document.pdf dumps every metadata field it can find, including XMP blocks a viewer will not show you.
A text editor. Crude but revealing. Open a PDF in a plain text editor and much of it is binary noise, but metadata strings are often stored as readable text. Searching for your own name is a quick sanity check. This is also how you spot appended revisions — multiple %%EOF markers mean the file has been saved incrementally more than once.
Reducing what you ship
Check before sending anything outside your organisation. Ten seconds in document properties. Make it a habit for anything going to a client, a court, a portal, or the public.
Fix the source, not just the output. Author metadata usually comes from your account name in Word, your OS user, or your PDF software's preferences. Setting it correctly once stops the leak at the origin rather than requiring cleanup on every file.
Save-as rather than save, for documents with long edit histories. A fresh save typically rewrites the file rather than appending, discarding accumulated revision history. This is also why files often shrink dramatically after a save-as.
Flatten when the structure is not needed. Converting pages to images and back — via PDF to JPG and JPG to PDF — destroys metadata, form values, annotations, and hidden content in one pass, because none of it survives becoming pixels. The cost is real: you lose selectable text, searchability, accessibility for screen readers, and file size goes up. It is a blunt instrument, appropriate when you genuinely need to be certain nothing structural survives.
For anonymity, assume the file is not anonymous. If a document must not be traceable to you, metadata stripping is necessary but not sufficient. Writing style, fonts available on your system, timestamps, and the toolchain fingerprint all narrow the field. Treat metadata removal as one step, not the whole job.
The honest summary
Most PDF metadata is mundane and nobody will ever look at it. But it is created automatically, it travels invisibly, and the cost of checking is a few seconds. The documents where it matters — filings, submissions, anything anonymous, anything leaving your organisation — are usually obvious in advance. Check those.
