Security 7 min read 2 October 2026

What Your PDF Metadata Reveals About You (And How to Clean It)

Q: What is the xmpMM:DocumentID and why does it matter?

xmpMM:DocumentID is a UUID assigned when the document is first created, and it never changes. All versions, copies, and derivatives of the same source document share the same DocumentID. This allows someone to establish that two PDFs are versions of the same document even if they have different filenames, different authors listed, and different dates. For documents that should appear independent (separate tender submissions, anonymised court exhibits), a shared DocumentID reveals the connection. See the XMP Metadata glossary entry for full detail.

Q: Can metadata reveal if a document was modified after a stated deadline?

Yes. The /ModDate field in the Document Information Dictionary and the xmpMM:History property in XMP both record modification timestamps. If a document was edited after a stated deadline, these fields contain the evidence. In legal and contractual contexts, metadata timestamps have been used as evidence of after-the-fact modification. This is why metadata cleaning is standard practice for legal document submissions and whistleblower disclosures.

Every PDF you share carries hidden data: who created it, what software they used, when every edit was made, the hostname of the machine, and a unique document ID that links all versions. This guide maps every metadata field, shows what each reveals, and gives a step-by-step process for cleaning documents before sharing.

Every PDF you create and share carries a layer of hidden data that most people never think about. This metadata is not in the visible content of the document — it does not appear on any page, in any paragraph, or in any heading. But it is readable by anyone who knows where to look, and it can reveal far more than the document's authors intended. The metadata embedded in a typical PDF from a business workflow includes: the full name of the person who created the document, the names of everyone who edited it, the software and version used on every machine that touched the file, the exact timestamp of every save event, a unique document ID that links all versions of the file together, the hostname of the computers it was processed on, and sometimes the original filename and directory path. In isolation, this seems harmless. In context — a sensitive contract being reviewed by an opposing party, a legal filing being analysed by journalists, a document submitted as evidence — it can reveal the timeline of a negotiation, the identity of a ghostwriter, the fact that a "final" document was modified after a stated deadline, or that two ostensibly independent documents came from the same source. This guide maps every metadata field, shows what each reveals, and gives a step-by-step process for cleaning a document before sharing it.

Document Information Dictionary: the visible metadata fields

Every PDF contains a Document Information Dictionary (DID) — a simple key/value store that has been part of the PDF format since version 1.0. These fields are readable by any PDF viewer in File → Properties (or equivalent): /Title — The document's title. Often auto-populated from the filename or the document's heading. Can reveal the internal working title of a document that differs from its distributed name. /Author — The name of the person who created the document. Typically taken from the operating system user account or the application's registered user name. Reveals the actual creator even if the document claims to be from an organisation or is distributed anonymously. /Subject — A subject description, often blank but sometimes auto-populated from application templates. /Keywords — Keyword tags, often blank in business documents but sometimes populated with internal categorisation terms or document management system codes. /Creator — The application used to create the original document (e.g., "Microsoft Word 2021", "Adobe InDesign 18.0"). Reveals the authoring software. /Producer — The application that generated the final PDF (e.g., "Adobe PDF Library 21.11.0", "Microsoft: Print To PDF"). May differ from /Creator if the document was exported from one application and converted by another. /CreationDate — The timestamp when the PDF was first created. In UTC or local time with timezone offset. /ModDate — The timestamp of the most recent modification to the PDF. If a document was modified after a stated deadline, /ModDate is the evidence. /Trapped — A print production flag; rarely relevant outside publishing workflows.

XMP metadata: the richer layer

Since PDF 1.4, documents carry an additional metadata layer: an XMP (Extensible Metadata Platform) stream containing structured XML. XMP overlaps with the DID fields but adds significantly more: xmpMM:DocumentID — A UUID generated when the document was first created and never changed, even through revisions and exports. Two PDFs sharing a DocumentID were created from the same source file. This can establish a connection between documents that were intended to be independent — a fact exploited in several high-profile document analysis investigations. xmpMM:InstanceID — Changes on every save. Allows tracking of specific document versions even when filenames are identical. xmpMM:History — A structured log of every save event: timestamp, the application name (sometimes including the username), and the action taken. This is the most revealing property in enterprise documents — it can reconstruct the complete revision history of a sensitive document, including saves that occurred outside normal business hours, on unusual machines, or under unexpected user identities. xmpMM:DerivedFrom — If the document was created by saving a copy or exporting from another document, this field may reference the source document's ID. Establishes provenance relationships between files. xmp:CreatorTool — The specific application and version used to create the file. dc:creator — A Dublin Core creator field, often populated from the OS user account. photoshop:AuthorsPosition, photoshop:CaptionWriter — Adobe application-specific fields that may appear in documents touched by Creative Suite tools, sometimes containing real names and job titles.

Embedded thumbnails, ICC profiles, and other hidden data

Beyond named metadata fields, PDFs may contain other embedded data that reveals information: Embedded page thumbnails — Some PDF creation tools embed small rasterised previews of each page inside the file. These thumbnails are visible to tools that inspect the PDF object graph even if the main content is encrypted or partially removed. For a document with content that was visually covered (not truly redacted), the thumbnail may show the original uncovered version from the moment of thumbnail generation. ICC colour profiles — Embedded colour profiles may identify the specific output device (monitor model, printer) the document was prepared for, which can in some cases be linked to a specific workstation or production environment. Digital signature artifacts — If a document was digitally signed, the signature object contains the signer's certificate, which includes their name, email address, and the Certificate Authority that issued the certificate. Embedded fonts with metadata — Font programs embedded in the PDF may contain metadata including the font foundry, licensing terms, and sometimes the name of the original font licence holder. Content streams with user-identifying data — Some applications embed user names or machine identifiers directly in content stream comments or as invisible text. This is less common but has been documented in specific authoring tool versions.

How to clean metadata before sharing

Option 1: ExifTool (free, command-line) ExifTool by Phil Harvey is the most comprehensive free metadata tool available. To remove all metadata from a PDF: exiftool -all= document.pdf This removes both DID and XMP metadata. To preserve specific fields (title and creator only): exiftool -all= -Title="Document Title" -Author="Organisation Name" document.pdf Note: stripping all metadata from a PDF/A document breaks its archival conformance — the PDF/A namespace declarations are required. Option 2: Adobe Acrobat Pro Tools → Redact → Sanitize Document — this performs a full sanitisation including metadata, embedded content, hidden layers, and overlapping objects. More thorough than ExifTool for non-metadata hidden content. Alternatively: File → Properties → Description → Additional Metadata — allows manual editing of individual XMP fields. Option 3: Print to PDF "Printing" a PDF to a virtual PDF printer (e.g., Microsoft Print to PDF, macOS Save as PDF) produces a new PDF with fresh metadata from the print event. The creation history, DocumentID, edit history, and authoring-tool-specific fields are all replaced. The trade-off: vector content (text, shapes) may be rasterised to images, losing searchability and accessibility. Option 4: LibreOffice Opening a PDF in LibreOffice Draw and re-exporting to PDF gives you control over what metadata is written on export via the document properties dialog.

PDF metadata is not a security feature — it is a convenience feature for document management that becomes a liability when files are shared outside their intended audience. Before distributing any document that contains sensitive information, run it through ExifTool or Acrobat's sanitisation tool, and verify the output. Five minutes of metadata cleaning can prevent months of consequence.

Frequently asked questions

Can I see the metadata in a PDF without any special software?

Yes. In any PDF viewer: File → Properties (or Document Properties) shows the Document Information Dictionary fields — title, author, creation date, modification date, and producer/creator tool. For the full XMP metadata including edit history, you need ExifTool (exiftool document.pdf) or Adobe Acrobat Pro's Additional Metadata dialog.

Does removing metadata affect the document's content or appearance?

No. PDF metadata is stored separately from the page content streams. Removing it has no effect on how the document looks or what text it contains. The one exception is PDF/A archiving documents — these require specific metadata fields in the XMP to declare their conformance level; stripping all metadata from a PDF/A file breaks its archival conformance.

What is the xmpMM:DocumentID and why does it matter?

xmpMM:DocumentID is a UUID assigned when the document is first created, and it never changes. All versions, copies, and derivatives of the same source document share the same DocumentID. This allows someone to establish that two PDFs are versions of the same document even if they have different filenames, different authors listed, and different dates. For documents that should appear independent (separate tender submissions, anonymised court exhibits), a shared DocumentID reveals the connection. See the XMP Metadata glossary entry for full detail.

Does printing a PDF to PDF remove metadata?

Mostly yes. Printing to a virtual PDF printer creates a new file with fresh metadata from the print event — the original creation history, DocumentID, and edit history are replaced. However, this also rasterises vector content in many implementations, losing searchable text and accessibility features. For metadata cleaning without quality loss, use ExifTool or Adobe Acrobat's sanitisation tool.

Can metadata reveal if a document was modified after a stated deadline?

Yes. The /ModDate field in the Document Information Dictionary and the xmpMM:History property in XMP both record modification timestamps. If a document was edited after a stated deadline, these fields contain the evidence. In legal and contractual contexts, metadata timestamps have been used as evidence of after-the-fact modification. This is why metadata cleaning is standard practice for legal document submissions and whistleblower disclosures.

Try it yourself

Everything in this article can be done directly in the free PDFTheGuide editor — no account required.

Redact PDF Whiteout PDF content Annotate PDF Open editor