What a PDF knows about you

PDFs carry author names, software fingerprints, timestamps and file paths in places that surviving an export or a flatten is not obvious. Where to look, and what actually removes it.

21 September 2026 · Reference

A PDF contains more than the page. It carries metadata describing who made it, with what, when, and sometimes where the source file lived on their machine. Most of it is set without anyone choosing to set it.

Two places metadata lives

PDF has carried metadata in two parallel systems since 2001, and they do not always agree.

Because both exist, a tool that clears one may leave the other populated. A file can show a blank Author in Acrobat's properties panel and still carry your name in its XMP packet.

How do I see all the metadata in a PDF?

exiftool document.pdf is the most thorough single command — it reads both the info dictionary and the XMP packet and prints everything, including fields Acrobat's properties panel does not display. pdfinfo gives a quicker summary. For a really careful look, decompress the file with qpdf --qdf and read it, since that surfaces anything sitting in the structure that neither tool enumerates.

What gets set without you choosing it

• Author — usually pulled from the operating system or application account name, which is frequently a real full name
• Creator — the application that composed the document
• Producer — the library that wrote the PDF, often with a precise version number
• CreationDate / ModDate — timestamps, including timezone offset, which discloses roughly where you are
• Title — often defaults to the source filename, which is how internal document names escape

The Creator and Producer pair is a precise software fingerprint. It identifies the toolchain and version, which is unremarkable on its own and occasionally revealing when a document is claimed to be older than the software that made it.

The paths problem

Some producers embed the full path of the source file. /Users/jane.doe/Clients/ Acme/Acme Proposal FINAL v7.pdf discloses a name, a client list, and a revision count in a single string. This is most common when PDFs are generated from design tools with linked assets, or when a document references an external file.

Does flattening a PDF remove metadata?

No. Flattening merges layers and form fields into the page content — it is an operation on what is drawn, not on the file's metadata. The info dictionary and XMP packet survive it intact. The same is true of merging, stamping and most "optimise" passes. Printing to PDF from a viewer usually does reset metadata, because it produces a genuinely new file, but it also discards tags, bookmarks, links and searchable structure along the way.

What actually removes it

• exiftool -all:all= file.pdf clears both systems, though it writes an incremental update — add -overwrite_original and then linearise, or the old values remain recoverable in the file's revision history
• qpdf --empty --pages file.pdf -- out.pdf rebuilds the file from the pages alone
• Acrobat's Sanitize Document removes metadata, hidden layers, embedded search indexes, attachments and deleted content in one pass. It is the thorough option and it is destructive
• A deliberate re-export with metadata fields cleared before export

Can old versions of a PDF be recovered?

Sometimes, yes. PDF supports incremental updates: a change can be appended to the end of the file rather than rewritten, leaving the previous version intact above it. Edits made this way — including redactions and metadata clearing — can be recovered by reading the earlier revision. Saving with "save as" rather than "save" usually rewrites the file completely. If a document has been edited and must not leak its history, rebuild it rather than trusting an append.

A short checklist before a document leaves

1. exiftool it, and read the output rather than skimming it
2. Check Title — it is frequently an internal filename
3. Check for path strings anywhere in the output
4. If it was redacted, extract the text and confirm the redacted words are gone
5. If it was edited, confirm you saved a rewrite rather than an incremental update

None of this takes more than a minute, and all of it has produced public incidents for organisations that skipped it.