How to remove hidden metadata and personal information from PDFs

When people send PDFs to clients, public portals or court registries, many of them believe that deleting visible text, or drawing black boxes over it (fake redaction), keeps private information safe. It does not. Hidden metadata, earlier revisions and searchable text layers are all still in the file, and anyone can pull them out in two clicks. The first step is to see what is actually in there, and PDF Metadata Viewer lists it.

Hidden Metadata Lurking Inside PDF Files

The PDF format has several structures that store background information you never see on the page:

• Document Info Dictionary (Info Dict): Stores the author's real name, the operating system login name, the company computer name, creation dates and the versions of the software used. Its fields are defined in the ISO 32000-1 PDF specification.
• XMP Metadata (Extensible Metadata Platform): XML streams that can hold edit history, digital camera serial numbers and thumbnail previews of pages that were deleted.
• GPS Coordinates: Scanned documents and smartphone photos placed in the file keep their exact latitude and longitude.
• Underlying OCR Text Layers: A black shape drawn over text is only a rectangle placed on top. The text underneath can still be copied and pasted in full.

How to Properly Sanitize and Redact PDF Documents

1. Permanent Pixel Rasterization or Object Pruning: Real redaction removes the actual characters and their positions from the PDF content stream. A cover on top is not enough. Redact PDF removes the text itself and does not just draw a rectangle.
2. Strip All Metadata Dictionaries: Remove the /Info dictionary and the /Metadata streams completely with Remove PDF Metadata. For images, videos and Office files the equivalent is the metadata stripper.
3. Purge Deleted Object Incremental Updates: A PDF can save changes by adding new data to the end of the file, and the old versions are not erased. Always flatten the PDF or rebuild its object graph.

Client-Side Sanitization for Strict Compliance

Doctors, lawyers and finance professionals have a legal duty to keep client information confidential. When you clean a file inside your browser, the metadata is removed on your own machine, before the document goes anywhere near an email client or a public upload server.