What is PDF Metadata?

PDF metadata is information about a PDF document that's stored in the file but not visible when you read the document. Think of it like the spine of a book — it tells you the title, author, and publisher without you having to open it. The difference: PDF metadata is auto-populated by your editing software and reveals much more than you'd expect.

There are two places metadata lives in a PDF: the Info Dictionary (a flat key-value list with fields like Author, Creator, Producer, Title, Subject, Keywords, CreationDate, ModDate) and the XMP block (an XML metadata block that can duplicate and extend the Info Dictionary, often added by Adobe tools and enterprise PDF generators). Both need to be stripped for complete metadata removal.

PDF metadata has been used in court cases (timestamps contradicting execution dates), academic peer review (anonymous reviewers identified by Author field), journalism (whistleblowers identified by software fingerprints), and corporate espionage (internal network structure leaked via file paths). It's a real and underappreciated privacy risk.

Author — typically auto-populated from your OS account (Windows) or Adobe account (Acrobat). Often your real full name. On corporate Office 365 deployments, often your full corporate email address.

Creator — the software that created the original document (e.g., 'Microsoft Word for Office 365', 'LaTeX with hyperref package', 'Adobe InDesign CC 2024'). Reveals your toolchain and sometimes your employer.

Producer — the PDF generation library that converted the source document to PDF (e.g., 'Adobe PDF Library 17.0', 'pdf-lib 1.17.1'). Combined with Creator, can fingerprint your specific installation.

Title — usually the first heading of the document, auto-populated. Sometimes reveals content you'd rather not disclose (e.g., 'Confidential — Q4 2026 Layoffs Plan').

Subject — usually empty unless explicitly set. Some templates populate it with project names or client names.

Keywords — usually empty unless explicitly set. Some templates populate with project tags.

CreationDate — when the PDF was created, with timezone. Reveals your working hours and timezone, which can identify your location.

ModDate — when the PDF was last modified. Can contradict a document's stated execution date (forensics experts use this).

Your identity: the Author field often contains your real name (auto-populated from your Windows or Adobe account). On corporate Office 365 deployments, it's often your full corporate email.

Your employer: the Creator field reveals your editing software, which can identify your employer. 'Adobe InDesign CC 2024 (Macintosh)' suggests a design studio. 'Microsoft Word for Office 365' suggests a corporate environment. 'LaTeX with hyperref' suggests academia.

Your location: the CreationDate includes a timezone offset. If your PDFs are consistently created at +05:30, you're in India. +09:00 = Japan/Korea. -08:00 = US West Coast. Forensic analysts use this to narrow down your location.

Your working hours: if all your PDFs are created between 9 AM and 5 PM local time, that suggests a regular office worker. Late-night or weekend creation suggests a different work pattern. Some legal cases have used this to question document authenticity.

Your internal network structure: some PDF generators embed the original file path in metadata. 'C:\Users\jdoe\Documents\clients\acme-confidential-draft.docx' reveals your Windows username (jdoe) and your client folder structure.

Your editing history: ModDate timestamps can reveal that a 'final' document was actually modified the night before signing, or that multiple revisions happened over weeks when the document was supposedly drafted in one sitting.

Academic peer review: a study of double-blind submissions found 15-30% contained Author metadata identifying the submitter. Reviewers using Adobe Reader could see the author's name in 2 clicks (File → Properties).

Whistleblower identification: in 2018, a whistleblower's submission to a news outlet was traced back to them because the PDF's Creator field revealed the specific version of Word used by their employer's IT department.

Legal document authenticity: in a 2020 contract dispute, the PDF's ModDate timestamp revealed the contract was modified the day before signing — contradicting testimony that it had been finalized weeks earlier. The contract was invalidated.

Corporate espionage: a leaked corporate strategy PDF was traced to a specific employee because the original file path (embedded in metadata) included their Windows username.

Anonymous job applications: researchers found that 40% of 'anonymous' resumes submitted to companies using blind hiring still contained Author metadata with the applicant's real name.

Option 1: PrivacyScanPDF scanner (privacyscanpdf.com). Drop your PDF, see every metadata field plus 50+ PII detection patterns, all in your browser with zero uploads. Free.

Option 2: Adobe Reader (free desktop app). Open the PDF → File → Properties → Description tab. Shows Author, Title, Subject, Keywords, Creator, Producer, CreationDate, ModDate.

Option 3: macOS Preview. Open the PDF → Tools → Show Inspector (Cmd+I). Shows the same Info Dictionary fields.

Option 4: Text editor. PDFs are mostly text-based — open in any text editor and search for '/Author', '/Creator', '/Producer', '/Title'. The values appear in parentheses after the slash-prefixed keys.

Option 5: Command line (exiftool). 'exiftool document.pdf' shows every metadata field. Most thorough option but requires installing exiftool.

Use a browser-based metadata stripper like PrivacyScanPDF (/?mode=remove-metadata). It removes all Info Dictionary fields AND the XMP XML metadata block in one operation, processing entirely in your browser. Your PDF never leaves your device.

Don't rely on 'Save As' to remove metadata. 'Save As' preserves original metadata by default. Some PDF editors let you selectively clear fields via File → Properties, but this is per-field, manual, and easy to forget. A dedicated metadata stripper is faster and more reliable.

Don't use 'Print to PDF' as a metadata stripper. Some people print a PDF to 'Microsoft Print to PDF' to strip metadata — this works partially (strips Author/Creator) but adds new metadata (Microsoft Print to PDF as Creator) and re-rasterizes the document (losing vector quality, breaking text selection). Use a proper metadata stripper instead.

Verify removal: after stripping, drop the PDF back into the PrivacyScanPDF scanner. All metadata fields should show '(empty)' or be absent. You can also open the PDF in a text editor and search for '/Author' or '/Creator' — they should be gone or empty.