← All posts

Does clearing a PDF’s metadata make it anonymous?

You are about to send a document to someone you would rather could not trace it back to you. A submission, a complaint, a survey answer, a disclosure. Somebody told you to strip the metadata first, so you did — the properties panel is empty now, no author, no dates, nothing.

The question you actually want answered is whether that was enough. Every page you found while looking says how to remove metadata. None of them says whether removing it does what you are hoping it does.

It does not. Clearing metadata is a real step and worth doing, and it is nowhere near sufficient on its own. Here is exactly what it removes, exactly what it leaves, and what order to do things in.

What "the metadata" actually is

A PDF describes itself in a small dictionary stored near the end of the file — the document information dictionary. It holds eight or so entries: Title, Author, Subject, Keywords, Creator, Producer, CreationDate, ModDate. That is what your reader shows under Document properties, and it is all that most "remove metadata" buttons touch.

Many files describe themselves a second time, in an XMP packet: the same facts again as a block of XML attached to the document catalogue. Two copies, written by different parts of whatever produced the file, and readers disagree about which one wins. A tool that clears one and leaves the other gives you a file that answers the question differently depending on who opens it.

Our Edit PDF metadata tool has a clear everything first option that replaces the information dictionary with an empty one — including the two dates, which no properties panel lets you edit — and then drops the XMP packet as well, so there is no second copy left to contradict the first. If you want to know what those fields were saying about you before you cleared them, created with and produced by are the two that talk most, and the title is the one everybody sees without looking.

That is the whole of what clearing metadata does. Data about the document. Nothing in the document itself moves by a single point.

What it leaves exactly where it was

In rough order of how often each one is the thing that identifies somebody:

The text. Your name in the signature block, the letterhead, the case reference, the client code in the footer, the address on page four. Metadata hygiene is not redaction and does not pretend to be. This is by far the most common way a "cleaned" document identifies its author, and it is the one people forget precisely because they were busy with the properties panel.

Every comment carries a name. A sticky note, a highlight, a strikeout — each one stores an author string and a timestamp of its own, on the annotation, nowhere near the information dictionary. Clearing the metadata does not touch them. Neither does looking at the document, because most readers only show the name when you hover.

Form field values. Whatever was typed into the form is stored in the field, not drawn on the page, and it survives everything except deleting the fields or flattening them.

Attached files. A PDF can carry other files inside it — a spreadsheet, the original Word document, a photograph — and those arrive with their own metadata intact. The covering letter is clean and the attached spreadsheet says who made it. None of our tools removes them: our annotation stripper takes attachments that were pinned to a page, and leaves the document's own attachment list alone. pdfdetach -list shows you what is there, and qpdf --empty --pages in.pdf 1-z -- out.pdf builds a new file out of the pages alone, which leaves the attachment list behind — along with the bookmarks, so check what else you lost.

Pictures of you, and pictures you cropped. Photographs embedded by some producers keep their original JPEG markers, camera model and GPS included. And a crop in a PDF is a viewing window, not a deletion — the part outside the frame is still in the file.

The file name. smith-grievance-v3-FINAL.pdf is not metadata and no metadata tool touches it.

The file identifier. The trailer carries a two-part ID, and the first part is designed to stay constant across every version of a document, so that two files can be recognised as descendants of the same original. Clearing the metadata does not clear it. Whether it survives a re-save depends entirely on the tool. qpdf --show-object=trailer file.pdf prints it.

Earlier versions of the file itself. PDFs can be saved incrementally: each save appends the changed objects and leaves the previous ones in place, unreferenced but entirely readable. If somebody edited the document before you got it, the version before their edit may still be sitting in the same file.

The order to do this in

Doing these in the wrong order wastes the work, because most tools stamp their own Producer into the file each time they save it. Metadata goes last.

  1. Look at the file the way the recipient will. Our PDF inspector reads the title, author, producer, dates, form field count and text layer in your browser without uploading anything. Then run pdftotext -layout file.pdf - and actually read the output. It prints every character the file contains, including the ones nobody can see on the page.
  2. If a completed form's answers have to stay, flatten it first. Flatten PDF draws the field values into the page as ordinary content and deletes the fields, so the form stays readable but can no longer be re-typed or read out of the field objects. This has to happen before the next step, because removing the fields removes the answers with them.
  3. Strip the mark-up. Remove annotations from PDF removes comments, highlights, ink, stamps and the author name and timestamp attached to each of them, and — with everything or form fields — the form definition as well. The pages themselves are not touched.
  4. Take the identifying words out of the text. The PDF editor removes the glyphs from the page's content stream rather than covering them: the show-text operator is replaced by a spacing adjustment of the same width, so the line does not reflow and the removed characters are not underneath anything. That is genuinely different from painting a black rectangle over a name, which leaves the name selectable, searchable and one copy-and-paste from being read.
  5. Clear the metadata. Edit PDF metadata, clear everything first, boxes left empty.
  6. Check your own work. Run pdftotext again on the finished file. Run pdfdetach -list out.pdf to list attachments — a tool we do not have, and poppler-utils is free on every platform. Open the result in the inspector one more time.

The blunt instrument that actually works

If the document is going to a hostile reader and you cannot audit every object in it, stop trying to subtract things and rebuild it instead. PDF to JPG draws each page exactly as a reader draws it and gives you pictures. Text hidden under a black box is not drawn. Invisible OCR text is not drawn. Annotations that were never displayed are not drawn. Attachments do not come. What survives is precisely what a human eye can see, which is the only guarantee of that kind you can get cheaply. JPG to PDF puts the pages back into a PDF afterwards.

The price is real and you should count it before you pay it. The result cannot be searched, selected or read by a screen reader; it is usually several times larger; and it is obvious to the recipient that you did it. For an anonymous submission that trade is often correct. For a document somebody has to work with, it is not.

When a desktop tool is genuinely better

All of these are free, and for this job they beat anything that runs in a browser — including us, because none of it involves uploading a sensitive document to a stranger.

The exiftool warning is not optional. ExifTool writes changes to a PDF as an incremental update, which means your original metadata is still in the file and is recoverable — the tool will even undo it for you with -pdf-revert. Clearing metadata with exiftool and stopping there leaves the file looking clean and reading dirty. Always follow it with a qpdf pass that writes the document out fresh.

The part no tool can do anything about

A file can be perfectly clean and still name you. You are the only person outside the department who had that draft. The phrasing is yours. The complaint is about something only four people witnessed. Six pages of your writing is enough for anyone with a reason to care.

If the document was printed and scanned, most colour laser printers add a faint pattern of yellow dots to every page encoding the printer's serial number and the date. It is invisible at arm's length and survives the scan.

And the document is not the only thing that travels. The email account, the upload, the timing, the network you sent it from — those carry more identifying information than the PDF ever did, and no amount of metadata clearing touches any of them.

Clear the metadata. It is real, it takes twenty seconds, and it removes information that is genuinely there. Just do not let an empty properties panel be the moment you stop looking.

Tools this post uses: