TL;DR
PDFs embed metadata like the author's name, creation software, edit timestamps, and sometimes GPS coordinates from photos. Stripping this metadata before sharing sensitive documents is a basic privacy step most people skip.
A PDF looks like a finished document. It is a final, read-only version of whatever you created. What most people do not realize is that PDFs often carry a second layer of information that is not visible when you open the file normally: metadata embedded during creation and never cleaned out.
Before you send a PDF to a client, a journalist, a prospective employer, or a legal proceeding, here is what it might contain.
1. The Author's Name
Most PDF creators embed the name of the person who created the file in the Author metadata field. If you created the document in Microsoft Word or Google Docs and exported it, your account name is likely in there. If the document is supposed to be anonymous, it is not.
2. The Software That Created It
The Creator and Producer fields record the application used to create the PDF and the software used to export it. Microsoft Word for Microsoft 365 tells a reader both the tool and roughly the era. This can matter in forensic analysis, in competitive intelligence, and in any situation where the origin of a document is in dispute.
3. The Creation and Modification Timestamps
PDFs store when the file was first created and when it was last modified. These timestamps reflect the local system time of the machine that did the work. Sending a document timestamped three days before a claimed deadline tells a different story than the claim.
4. The Original File Path
Some applications embed the full file path of the source document. This reveals the operating system, the username, and the internal filename, including draft labels or version numbers you did not intend to share.
5. Revision History Notes
Documents that went through review cycles in Word or LibreOffice sometimes retain revision metadata even after export. Track changes data, comment author names, and edit history can survive into the PDF.
6. GPS Coordinates in Embedded Images
If your PDF includes photos taken on a smartphone, those photos may carry EXIF metadata including the GPS coordinates of where they were taken. Embedding a photo from your home office into a confidential document can embed your home address.
7. Fonts and Document Structure
The fonts embedded in a PDF reveal design choices, software capabilities, and sometimes licensing information. Corporate templates often use licensed fonts that indicate the creator's organization.
8. Custom Properties
Applications like Word allow you to add custom document properties: client name, project code, document status, internal reference numbers. These are often filled in automatically by document management systems and routinely forgotten when files are exported for external distribution.
9. Hidden Layers or Objects
Some PDFs contain objects that are not visible in normal viewing but are present in the file structure. Redacted text that was covered with a black rectangle rather than actually removed is a well-documented example. The text is still in the file. It just is not rendered.
10. Digital Signatures and Certificate Information
PDFs signed with a digital signature include the certificate used to sign them. That certificate contains the signer's name, email address, the issuing certificate authority, and validity dates. This is useful for verification, but it is also information the recipient did not necessarily expect to receive.
What to Do About It
Before sharing any PDF that contains sensitive content:
- Open it in a PDF reader that shows document properties (File, Properties in most applications).
- Look at the metadata fields and decide whether that information should be visible to the recipient.
- If you need to strip metadata, use a tool designed for that purpose. Simply re-saving a PDF usually preserves all existing metadata.
- For images embedded in the document, strip EXIF data from the source photos before inserting them.
The PDF tools on this site process files entirely in your browser. Nothing is uploaded to any server. If you need to extract text from a PDF, split pages, rotate, or rearrange it, all of that happens locally on your machine.
The metadata problem is a reminder that documents are not as neutral as they appear. They carry a history. Make sure you know what history you are sharing before you hit send.
Khodor Ghalayini
Engineer · AI Builder · Cybersecurity Practitioner
Engineer with 10+ years in systems and project management. I build AI-powered tools to help people work smarter — starting with the security and productivity problems I've personally run into. More about me →