Everything inside a PDF besides the words

We build browser-based file tools and test every one of them against the forms and specs people actually have to satisfy.

A PDF is not a picture of a document. It is a container, and a surprising number of things ride along inside it that were never meant for the person you send it to.

Most of it is harmless. Some of it is the sort of thing that has embarrassed law firms, governments and job applicants. It is worth knowing which is which before you attach the file.

The document information block

Every PDF carries a small set of fields written by whatever produced it:

• Title — often not what you named the file. Frequently still the template’s title, or the first line of a document you copied from.
• Author — usually the account name on the machine that made it. This is how documents get sent out under a predecessor’s name, or a real name the sender meant to keep private.
• Subject and Keywords — rarely filled in, occasionally carrying notes from an internal system.
• Creator — the application the content came from.
• Producer — the library that wrote the PDF, often with an exact version number.
• Creation and modification dates — timestamps, usually with a timezone offset that indicates roughly where the machine was.

PDF properties shows all of this for your own file, along with the PDF version, encryption status, page sizes and whether there are form fields. Looking at a document you are about to send is a thirty-second habit worth having.

Why “Author” is the one that bites

It is set once, by the software, from your operating system account — and then it is inherited. Open a document, save a copy, edit it for a new client, send it: unless something overwrote the field, the original author is still in there. Firms have sent documents to one counterparty carrying another counterparty’s name in the metadata, and the second firm found it in seconds, because it takes seconds.

Things that are more surprising

• Cropping a page does not remove anything. A PDF crop sets a visible region — a box that says “show this part”. The content outside it is still in the file, and reversing the crop in an editor brings it back. The same applies to images cropped inside a document: the full original is often still embedded.
• A black rectangle over text is not redaction. It is a drawing on top. Select the area, copy it, paste it somewhere else and the words come back. Real redaction has to delete the underlying content, not cover it.
• Filled form fields keep their values and remain editable. If you fill in a form and send it, the recipient can change your answers — and if you filled it in, cleared it, and filled it again, earlier states can persist.
• Embedded fonts can name their source. A subset embedded from a licensed corporate font quietly indicates which organisation produced the file.
• Incremental saves keep history. PDF can append changes rather than rewrite the file, so a document edited several times may contain its own earlier versions. That is how “deleted” paragraphs have been recovered from published documents.
• Images keep their own metadata. A photograph placed in a PDF can bring its EXIF with it, including GPS coordinates.

What to do before you send

These are in order of effort, and the first two cover most situations.

1. Look. Open PDF properties and read the author, producer and dates. You cannot decide what matters without seeing it.
2. Strip what you do not need. Remove metadata clears the information block. If you would rather set it deliberately — a real title for a published document, a company as author — edit metadata does that instead.
3. Flatten anything interactive. Flatten PDF converts form fields into fixed page content so values cannot be changed and earlier states do not travel.
4. For genuine redaction, remove the content. Delete the text, or rasterise the page so only pixels remain. A covering rectangle is not enough, ever.
5. If a page was cropped to hide something, rasterise it rather than trusting the crop box.

What metadata is good for

It is not all liability. Title and author are what document management systems index on, what a library catalogue reads, and what makes a published report findable. A PDF going into the world as a public document benefits from accurate fields.

The rule that covers both: set metadata deliberately on documents you publish, strip it from documents you send. The problem is never that the fields exist — it is that they get filled in by accident.

A quick checklist by document type

• CV or job application — strip. The author field frequently carries a previous employer’s template, and the producer names your software version.
• Legal or contractual — strip, flatten, and redact properly. This is the category with real consequences.
• Filled government form — flatten so the values are fixed.
• Published report or whitepaper — set the fields properly rather than stripping them.
• Scanned ID or financial statement — check for embedded image EXIF as well as document metadata.

The short version

A PDF carries who made it, with what, when, and often what used to be in it. Cropping hides nothing, black boxes redact nothing, and form values stay editable. Look at the properties before you send, strip what you did not mean to include, and flatten anything interactive.

All of these run in your browser — which matters more here than almost anywhere else on this site, because a document you are checking for accidental disclosure is the last thing you want to upload to check it. How that works.