Right-click a PDF, open its Properties panel, and you see a handful of fields: author, title, maybe a creation date. That is a small fraction of what a PDF actually carries. The rest — extended metadata, embedded comments, form field values, sometimes an entire earlier draft — sits underneath, invisible to anyone who only checks Properties before hitting send.
What's actually in a typical PDF
- The Info dictionary. Title, Author, Subject, Keywords, Creator, Producer, creation and modification timestamps. This is what Properties shows you, and it is frequently wrong or stale — the "Author" field often holds whoever's name was on the software licence, not who actually wrote the document.
- XMP metadata. A separate, more detailed metadata block that many editors write alongside the Info dictionary and almost no viewer surfaces directly. It can duplicate or contradict the Info fields.
- The document ID. A pair of identifiers set when the file was created, sometimes reused across revisions in a way that can link documents you did not intend to connect.
- Comments and annotations. Review comments and track-changes-style markup can survive a "flatten" or export step that only removes their visible appearance.
- Embedded JavaScript and attachments. Uncommon in ordinary documents, but present often enough in files that started life as a template or a form.
- Form field values. If the PDF has form fields, their values are stored in the form dictionary — including ones you filled in and later deleted from view, which can still be present in the data even after the visible text is gone.
- Earlier revisions. Some editors append changes to a PDF rather than rewriting it, which means the file's own bytes can contain an earlier, unedited version of a page that a text editor or the right tool can recover.
Why this is worth caring about
Author attribution. A leaked "Author" field or document ID has identified the real source of a document meant to be anonymous or attributed to an organisation rather than a person — a real concern for whistleblowers, journalists protecting a source, and anyone publishing under an institutional name.
Internal timelines. Creation and modification dates can reveal when a proposal was actually written relative to when it was claimed to be, or that a "custom" document was copied from a template used for a different client.
Leftover review material. Comments, tracked changes and earlier revisions can contain exactly the internal discussion — pricing negotiations, legal caveats, a colleague's blunt opinion — that the final, "clean" version was supposed to leave out.
None of this requires anyone to have acted maliciously. It is simply what a normal editing process leaves behind by default, in a place almost nobody checks.
How to actually remove it
- Open the file in a tool that shows you the full picture, not just the Info dictionary — the four fields in a Properties panel are not the whole story.
- Review what it finds: Info fields, XMP packet count, embedded JavaScript, attachments, comments, form fields, and the document ID.
- Choose what to keep. You do not have to strip everything — a published report's Title field is often useful for search indexing, and an official document may be meant to carry your organisation's name as Author. The point is choosing deliberately rather than leaving whatever an editor wrote by default.
- Export the cleaned file, and share that version instead of the original.
The upload problem, again
Removing hidden data from a document is, by definition, something you should not have to upload the document to do — you would be sending the sensitive original to a third party specifically to have its sensitive parts removed, which defeats the point if that third party's own servers now hold a copy.
PDF Vault's Sanitize tool runs the whole inspection and removal step in your browser: the file is loaded without letting the library stamp its own producer and dates on top of what is already there, so what you see is what is really in the file, and the document is rewritten from scratch on export — which is also what drops any earlier revision history, since a from-scratch rewrite carries forward only what is explicitly kept.
A practical rule
For anything leaving your organisation — a client deliverable, a press document, a public filing — strip metadata by default and keep only the fields you have deliberately decided to disclose. For internal documents, it usually matters much less. The habit costs a few seconds and closes off an entire category of accidental disclosure that a Properties panel will never show you.