Remove PDF metadata — what's hidden in your file and why scrubbing matters
Every PDF carries metadata — names, dates, paths, software versions, sometimes much more — that the visible page contents never reveal. Most of the time this is harmless. Occasionally it leaks information you specifically did not intend to share: the original author's name on an anonymous submission, the file path of a draft on someone's confidential C drive, the authoring application that gives away your internal workflow. Here is exactly what metadata is in a typical PDF, the three categories of leaks worth caring about, and the limits of what scrubbing can actually do.
Three places metadata lives in a PDF
PDFs carry metadata in three structurally distinct locations:
- The /Info dictionary. The classic metadata block: Title, Author, Subject, Keywords, Creator (the source application — e.g. "Microsoft Word"), Producer (the PDF-generation library — e.g. "PDFKit"), and CreationDate / ModDate timestamps. Every PDF has this; what is in it varies enormously by generator.
- The XMP metadata stream. An XML-based metadata stream supporting much richer information than the /Info dictionary — Dublin Core fields, custom schemas, version history, contributor lists, embedded color profiles. Mostly populated by professional design and publishing tools (Adobe InDesign, QuarkXPress) and by archival systems (PDF/A producers always embed XMP).
- Per-element metadata. Annotations carry an author field. Form fields can carry default-value metadata. Embedded files can carry their own internal metadata. Cryptographic signatures carry signer-identity metadata that is part of the signature's validity proof.
What the scrub tool does and doesn't touch
Our Remove Metadata tool clears the /Info dictionary and the XMP stream completely. Every field becomes empty. The PDF's visible content — text, images, vectors, annotations — is untouched. So is per-element metadata (annotation authors, signer identities). Annotations that carry an Author field require flattening to strip — flatten first, then scrub, for a fully-clean document.
Cryptographic signatures contain metadata that is part of their validity proof. Removing the signature's metadata would invalidate the signature. The scrub tool intentionally leaves cryptographic signatures alone; if you need to strip a signed document's metadata, remove the signature first (via Acrobat Pro) and then scrub.
Three categories of metadata leaks worth knowing
The patterns that show up in real-world embarrassments:
- Author name on an anonymous submission. Conferences with double-blind review, government tip-line submissions, RFP responses where anonymity matters. The /Info dictionary's Author field is often pre-filled from the user's OS login name without their realizing.
- Original file path or filename. Some generators put the source filename ("C:\Users\jane\Documents\confidential.docx") in the /Info dictionary. This leaks the document's original name and the local user account. Even when you renamed the PDF to share, the metadata still says where it came from.
- Authoring application that reveals workflow. If your competitive bid says "Creator: Microsoft Word 2003" and theirs says "Creator: Adobe InDesign 2024", you have just told them you typed your bid in a 20-year-old word processor. Strip the Creator field for a level playing field.
When metadata scrubbing alone isn't enough
Three situations where scrubbing the /Info dictionary is the right START but you need additional steps:
- Documents with annotations or comments. Each annotation carries an author. Flatten the PDF first (Flatten tool), then scrub metadata. After flattening, annotations become page content and their author metadata is gone.
- Documents with embedded files. Embedded files carry their own internal metadata. Use Extract Attachments to inventory them; remove embedded files you do not need before scrubbing the outer document.
- Documents with hidden text or comments. PDF supports hidden text (used for OCR text layers behind images). Scrubbing metadata does not affect this. If you need to remove hidden text too, run AI · Redact with the appropriate categories.
What scrubbing cannot do
Two important limits worth knowing:
- Scrubbing cannot remove content. If sensitive information is in the visible text of the PDF, scrubbing metadata does nothing. Use Redact for visible content.
- Scrubbing cannot prevent metadata being re-added later. Once the metadata is stripped and the file is saved, the result is metadata-free. But if someone else opens that PDF in their editor and saves it back, their editor will re-populate /Info with their own Author name and a new ModDate. Always scrub at the LAST step before distribution.
Limits and compatibility
On the free web tool, metadata scrubbing handles PDFs up to 100 MB. Processing runs in your browser via pdf-lib; nothing is uploaded. Output is byte-compatible with every PDF viewer.
Common pairings: Flatten → Remove Metadata for fully-clean shareable PDFs. Remove Metadata → Sign for documents that need a fresh cryptographic identity. Compress → Remove Metadata for the smallest, cleanest deliverable.