PDF Metadata Explained
A journalist I know once received a leaked corporate document. Within a minute of opening it, she knew more about the file than the sender had intended: the creator's full name, the laptop's hostname, the exact software version used, and the local file path — which revealed the name of an internal project folder.
None of this was visible on the page. It was metadata — the file's hidden annotation about itself.
This article explains what metadata a PDF contains, why it matters, and how to clean it.
What's in this guide
What "metadata" means
Metadata is data about data. In a PDF, it's information stored alongside the content, not visible when you read the document, but available to anyone who opens the file with a tool that inspects it.
There are two flavours of PDF metadata:
- The Info dictionary — a small set of standard fields defined in the PDF specification (title, author, etc.).
- XMP metadata — an XML-based format that can hold far more, including custom fields, rights information, and application-specific data.
Both are optional, but most PDF-creation software writes to at least some of them by default.
The standard fields
| Field | Typical content |
|---|---|
| Title | The document's title (often pulled from the original document, sometimes blank) |
| Author | The name registered with the software — often your real name or username |
| Subject | Free-text subject (rarely filled in) |
| Keywords | Comma-separated words for indexing |
| Creator | The application that created the source document (e.g. "Microsoft Word") |
| Producer | The library that wrote the PDF (e.g. "Adobe PDF Library 15.0") |
| CreationDate | When the PDF was first created |
| ModDate | When it was last modified |
None of these are dangerous on their own. But they add up. The combination of "created on this date with this software by this author" is a fingerprint. It can be cross-referenced with other files the same person has produced.
Non-standard fields you don't see
Beyond the standard fields, PDFs often carry extra information that isn't part of the format specification:
- Original file paths. Some PDF creators store the full local path of the source document, e.g.
C:\Users\jsmith\Documents\Project_Nightingale\draft_v3.docx. That's a folder name leaked in full. - Application state. Embedded application-specific data — bookmarks, printer settings, view preferences — sometimes with usernames.
- Digital signature metadata. If the PDF was signed, the signature block stores the signer's identity (from the certificate) and sometimes their email.
- Embedded font names. Custom fonts sometimes include the foundry's name and version in the file, which can hint at the author's design software.
- XMP history. Some software maintains an XML-based edit history inside the file, listing previous saving operations.
Not every PDF has all of these. But most have some, and the ones that do often reveal more than the author expects.
Why this matters
Three concrete scenarios where metadata has caused problems:
Anonymity slips
A whistleblower sends a "sanitised" document to a journalist. The document's author field contains their real name. The anonymity is gone before the document is even opened.
Location leaks
A public government report contains the internal file path of the source draft. The path includes a project codename that reveals an unannounced policy. The path is readable by anyone with a PDF metadata tool.
Identity of a "neutral" source
A company publishes a "third-party review" of its own product. The PDF's creator field reads a name that turns out to be a current employee. The independence claim collapses.
None of these require advanced technical skills to discover. Basic PDF tools expose metadata directly, and browsers' built-in PDF viewers sometimes show it in file properties.
How to clean metadata
Cleaning metadata is straightforward. In DSPDF, use the Metadata Editor: load the PDF, see what fields are populated, clear or replace them, save.
A few important notes:
- Clearing doesn't mean deleting. Most tools set the fields to empty strings, but the fields may still exist in the file structure. For fully clean output, save with a tool that rebuilds the PDF from scratch.
- XMP is separate. The standard Info dictionary and XMP are separate structures. Some tools clear one but not the other. Our Metadata Editor focuses on the Info dictionary; if absolute certainty matters, verify with a dedicated PDF inspector like
pdfinfo. - Regenerate on save. If you edit the file afterwards with another tool, it may re-populate metadata with its own values (typically the software name and current date).
A habit worth building
Make metadata cleaning a step in your workflow for any document you share externally. It takes five seconds and prevents a whole class of accidental leaks. Think of it the way you think of removing EXIF data from photos before posting.
FAQ
What metadata does a PDF contain?
Standard fields: title, author, subject, keywords, creator, producer, dates. Plus non-standard extras: local file paths, application state, XMP blocks. The extra fields are where the surprises live.
Is metadata visible in a normal PDF reader?
Partially. Most readers show the Info fields under "Document Properties" or "Get Info." They don't show embedded paths or XMP. So even if your PDF reader shows nothing suspicious, hidden metadata may still be there.
Do all PDFs have metadata?
No. Some PDFs have none. But most have at least a creator and producer field, populated automatically by the software that made the file.
Can metadata be added back after clearing?
Yes — saving a cleaned PDF through any PDF editor will typically repopulate some fields (application name, save date). If you need fully clean output, keep the file final after cleaning.
Is metadata dangerous?
Not usually, but it can be. It's a small information leak each time you share a file. For sensitive documents, clean it before sharing.