What hidden data is in a PDF?

Document properties (the Info dictionary)

Every PDF can include a document information dictionary with Title, Author, Subject, Keywords, Creator (the application that made the original), Producer (the software that wrote the PDF), and creation and modification dates. Author is frequently filled in automatically from the account name on the computer that made the file. Titles often keep the original document’s working name, which can include a client, a case number, or a draft label.

XMP metadata

XMP is an XML packet embedded in the file. It usually repeats the document properties and can add more: the editing software, document and instance identifiers that link a PDF to the file it was made from, and in some workflows an edit history listing the tools used and when. Individual pages and images inside a PDF can carry their own XMP as well.

Annotations and comments

Annotations sit on top of the page: sticky notes, comments, highlights, stamps, drawn shapes, links, and file-attachment icons. Review comments often record the reviewer’s name and quote the text they refer to. Marks that look like redactions may be annotations that were never applied. Most viewers list them in a comments panel.

Form data

Fillable forms store field values in the file, including fields that are hidden, set to not print, or covered by something else on the page. A form can also include calculation scripts and submit actions.

Embedded files

A PDF can contain complete other files: a spreadsheet behind a chart, the original Word document, supporting images, or an email thread. These attachments are stored in the file and listed in the viewer’s attachments panel, which many people never open.

JavaScript and automatic actions

PDFs can include JavaScript and actions that run when the document opens, when a page is shown, or when a field changes. Legitimate uses include form validation. In readers that allow it, actions can also open a web address or submit form data, which is why security teams often strip them from files received from outside.

Content you can’t see on the page

• Hidden layers (optional content groups) that are switched off in the default view.
• Text drawn in white, in a tiny font, behind an image, or outside the visible page area.
• An invisible OCR text layer on scanned pages.
• Bookmarks and page labels, which can name people or sections that were removed.

Earlier versions: incremental updates

When some editors save a change, they append the changed objects to the end of the file instead of rewriting it. The older objects can remain in the file, so a deleted paragraph may still be recoverable by tools that read the earlier revision. Digital signatures rely on this mechanism deliberately — each signature covers the file as it was at that moment. Rewriting the file with a tool that produces a fresh copy is the usual way to drop the old revisions.

How to inspect a PDF

Document properties are under File → Properties in most viewers; the comments, attachments, bookmarks, and layers panels show the rest. On the command line, pdfinfo -meta file.pdf prints the Info dictionary and XMP, and exiftool file.pdf lists metadata fields.

GhostX’s X-ray reports a PDF’s document properties, whether XMP is present, annotations by type, embedded files, JavaScript, auto-run actions, form data, associated files, and encryption, and it scans the text for personal details. It runs in your browser. It does not currently detect incremental-update history or invisible text, so use the checks in our redaction guide for those.

How to remove it

GhostX’s PDF metadata removal blanks the document properties and sets both dates to a fixed placeholder, deletes the XMP packet from the document, pages, and images, removes JavaScript, auto-run actions, embedded files, associated files, and form data, strips actions and file attachments from annotations, resets the file identifier, and writes the result as a new file rather than appending to the old one. It keeps the page content and selectable text. Comment annotations themselves are left in place, so delete or flatten them if they matter.

Some PDFs are damaged or protected in ways that prevent a clean edit. In that case GhostX offers an explicit ‘Flatten & remove hidden data’ option instead: every page is rendered to an image and a new PDF is built from those images, which drops all metadata, scripts, attachments, and earlier revisions — at the cost of selectable text. Flattening is also the strongest option when you need certainty that no earlier revision survives.

Other options include Acrobat Pro’s Sanitize Document and Remove Hidden Information features, and command-line tools such as ExifTool and qpdf.

Frequently asked questions

• Does ‘Save As’ remove hidden data from a PDF?

  Not reliably. Saving a copy usually keeps the document properties, XMP, comments, attachments, and form data. Use a dedicated metadata removal or sanitize function, then inspect the result.

• Does printing to PDF remove metadata?

  Printing to PDF usually drops attachments, scripts, and interactive form fields and writes new document properties, but the result depends on the printer driver, and text typically stays selectable. Check the output rather than assuming.

• Can a PDF contain a virus?

  A PDF can contain JavaScript and embedded files, and malicious PDFs have exploited reader vulnerabilities in the past. Keeping your reader updated and removing scripts and attachments from files you pass on reduces the risk.

• Does removing metadata change how the PDF looks?

  No. Metadata removal leaves the page content as it was. Flattening changes the file structure — the pages become images and text is no longer selectable — but they look the same.