PDF Metadata — What It Reveals and How to Review It

I redacted a client name from every page of a diligence PDF — black boxes, exported, sent. The recipient replied: "Did you mean to leave Jane's login as Author in Document Properties?"

I didn't mean to. I didn't know to look.

Metadata is the paperwork equivalent of writing your phone number on the back of a envelope you thought was blank.

Quick answer

I redacted a client name from every page of a diligence PDF — black boxes, exported, sent. The recipient replied: "Did you mean to leave Jane's login as Author in Document Properties?"

What metadata is (and isn't)

Metadata describes the document — not the body text on page 1. Typical fields:

| Field | Example | Risk | |-------|---------|------| | Title | Draft Contract v4 | Reveals status | | Author | jane@firm.com | Personal / internal ID | | Subject | Project Falcon | Codename leak | | Creator | Microsoft Word | Low | | Producer | Adobe PDF Library | Low | | Created | 2026-03-14 | Timeline clues | | Modified | 2026-03-18 | Shows recent edits |

Advanced files carry XMP metadata — camera EXIF from embedded photos, custom XML from enterprise tools, sometimes geolocation on mobile scans.

Metadata is not removed by printing to PDF again unless the new export strips it (sometimes adds another software layer instead).

When metadata matters most

• Legal and M&A drafts shared externally
• Anonymous peer review submissions
• Whistleblower or journalist handoffs
• HR documents leaving the org
• RFP responses where internal codenames hide in properties
• Compliance packages where audit trail is good internally but bad outbound

Internal collaboration? Metadata helps version control. Outbound is where leaks bite.

How to review metadata before sending

Desktop PDF readers

Adobe Acrobat / Reader: File → Properties → Description / Initial View / Advanced.

Foxit, PDF-XChange, Preview (Mac): Inspector or Get Info panels vary — hunt "More Info" or "Document Properties."

Note every field. If Author shows Windows username DESKTOP-JSMITH, fix before send.

Before merge and compress

Merge PDF may preserve author from first source file. Compress PDF rarely sanitizes.

Workflow: sanitize → merge → compress → send — not the reverse.

Online upload tools

Uploading to random converters may log or retain metadata server-side even if they strip display fields. Treat like browser PDF privacy risk.

Step-by-step sanitization workflow

1. Export with clean properties — set Author/Title in Word/Google Docs export settings when available.

2. Open Properties in PDF viewer — record what's present.

3. Sanitize using tool that supports metadata removal (Acrobat Pro "Remove Hidden Information", some CLI tools, dedicated privacy scrubbers).

4. Re-check Properties — confirm Author blank or generic org name.

5. Visual redaction pass — metadata scrub ≠ content redaction. Test copy-paste under black boxes.

6. Password if needed — encryption doesn't hide metadata from all tools equally; sanitization still required (password guide).

7. Send — filename itself can leak (Smith_Jane_Review.pdf) — rename.

Metadata vs encryption vs redaction

| Control | Hides page content | Hides properties | Stops forwarding | |---------|-------------------|------------------|----------------| | Metadata scrub | No | Often yes | No | | Redaction | If done correctly | No | No | | Password | When locked | Partially | No | | Portal permissions | Sometimes | Sometimes | Better |

Use the combination your risk actually requires — not password alone.

Common mistakes

Assuming "Save As PDF" from browser is clean
Browser print PDFs add their own producer strings; author may still leak from HTML meta.

Trusting black highlight in Word export
Highlight ≠ redaction in PDF.

Merged PDF inherits wrong author
First file wins in some tools — reorder or scrub sources.

Ignoring embedded attachments
PDF can contain embedded files with their own metadata nest.

Corporate and legal context

Some firms require metadata scrub on all outbound PDFs — part of ISO 27001 or client DPAs. Build checklist:

• [ ] Author generic or blank
• [ ] Title non-revealing
• [ ] Custom XMP reviewed
• [ ] Embedded files removed
• [ ] Filename neutral

Related reading

• PDF Password Protection
• How Browser PDF Tools Protect Privacy
• Combining Scanned and Digital PDFs

Troubleshooting

What information is stored in PDF metadata? Common fields include title, author, subject, keywords, creator application, producer, creation and modification dates. Some PDFs embed XMP packets with even more detail.

Does metadata show my computer username? Often yes — many apps default author to account name or login email unless you change it before export.

Will compressing or merging PDFs remove metadata? Not reliably. Merge tools may combine metadata from sources or keep the first file's properties. Use explicit sanitization if required.

Limitations

Browser-based workflows for pdf metadata depend on file size, browser memory, and how the source file was created. Very large files, password-protected inputs, or unusual encodings may fail without a desktop alternative. Always keep an original copy before batch processing.

When not to use this approach

Skip browser-only processing when compliance requires audit logs, when files exceed practical browser limits, or when you need features your browser tool does not expose (bookmarks, form fields, digital signatures). In those cases, use dedicated desktop software or an approved enterprise pipeline.

Related tools

• Merge PDF — scrub sources before merge
• Compress PDF
• Split PDF — isolate appendix metadata risks

Key takeaways

• What information is stored in PDF metadata: Common fields include title, author, subject, keywords, creator application, producer, creation and modification dates.
• Does metadata show my computer username: Often yes — many apps default author to account name or login email unless you change it before export.
• Will compressing or merging PDFs remove metadata: Not reliably.

Conclusion

PDF metadata is the footnote nobody reads until it embarrasses you in Properties. Review author, title, and dates before every sensitive send, sanitize deliberately, don't confuse it with redaction or passwords, and remember the filename is metadata too. Clean pages aren't enough if Properties still tell your story.