Remove metadata from PDF files
Read every property the document carries, then take it out without changing a single page. Runs in your browser — no upload, no account.
Runs in your browser 0 bytes uploadedDrop your PDF here
Read and rewritten on this machine. No copy of the document is sent anywhere.
Remove metadata from PDF documents before they leave your desk
Most documents that cause trouble do not cause it on the page. A tender goes out with the author field naming the analyst who priced it. A policy circulates with a title still reading draft for legal — do not distribute. A letter to a claimant carries a company field naming the firm that drafted it, filled in years ago by whoever installed the word processor. None of that shows when the file is open. All of it shows in a file listing, an email client, a search index and any script that reads a folder, and it travels with every copy anybody forwards.
Cleaning those fields by sending the document to an unknown server has an obvious flaw once you say it out loud, and it is sharper than the general case for privacy. The properties you want removed usually name a person, a client or a matter; transmitting the file to have them deleted discloses them to one more party before deleting them from none. So this runs where the file already is. A PDF library comes down from this domain the first time you hand something in — identical for everyone, never fetched for a visitor who only reads — and after that the wire is idle. The claim is checkable in a minute, and the procedure for checking it is written out and applies here as much as anywhere.
PDF, in brief
| Full name | Portable Document Format |
|---|---|
| Extension |
.pdf
|
| Format type | Fixed-layout document |
| MIME type |
application/pdf
|
A PDF metadata viewer that shows the fields nobody knows to look for
Before anything is taken out, everything found is listed by name with its value. Eight of those names are defined by the specification: title, author, subject, keywords, the application that created the document, the software that produced the file, and two timestamps. Those are the ones a properties dialog will show you, and if the story ended there a right-click would be enough.
It does not end there, for two reasons that make this worth running even when you have already tidied a file by hand. First, the dictionary is open: a producing application may add any key it likes, and word processors routinely add a company name, a manager, a source-modified stamp and internal identifiers that no dialog displays. Those keys are shown here and highlighted, because they are precisely the ones that survive a manual clean-up. Second, most documents carry a second copy of everything in a packet of XML stored as a stream on the document object. Editing the visible properties in many programs updates the dictionary and leaves that packet exactly as it was, so a document whose properties look empty can still name its subject to anything that parses it. Both are cleared, along with metadata attached to individual pages, which is rarer and correspondingly easier to miss.
Your pages are not rebuilt, and that is the whole difference
It is worth separating two jobs that sound similar and are not. Redacting concerns what is printed on the pages: a name in a paragraph, a figure in a table, a signature. Removing metadata concerns what the file says about itself. They fail in opposite directions, and the common mistake is to do the first and forget the second — blacking out a name in the body of a memo whose title has been announcing the same name in every folder it has ever sat in. If the words on the page are the problem, redacting a PDF is the operation you want, and it has a real cost: a page that is redacted here is rebuilt as an image and loses its selectable text.
This page has no such cost, because it never touches a page at all. The page objects, their content streams, their fonts and their exact dimensions are carried straight across. Text stays selectable and searchable, links keep working, and filled form fields remain fillable — which is not automatic, since the obvious way to rewrite a PDF discards the form index along the way. The output does carry one deliberate absence worth naming: it holds no producer string and no timestamp of ours either. A stamp recording when a document was cleaned would be a new fact about the document, added by the very operation meant to remove them.
One option is offered rather than assumed. If the document declares a language, that declaration stays unless you say otherwise. It says nothing about any person; screen readers use it to pronounce the text with the right voice, and sweeping it up with the rest would quietly degrade the file for the readers who depend on it most.
How to check PDF metadata is gone, and what could still be wrong
Two checks run on the finished document and they are built on different machinery, which is the point. One reopens the output with the same reader and reports what can be read from it. The other searches the raw bytes for the XML signatures and for the actual values pulled out of your file — the title, the author, the company — without interpreting the document structure at all. The second exists because the first has a blind spot shaped exactly like the reader: anything the parser fails to recognize is neither removed nor reported, so a check resting on it alone would answer clean out of the same ignorance that caused the problem.
A measurement made while building this page shows why that matters more than it sounds. PDF writers commonly store text strings as hexadecimal digits spelling out a sixteen-bit encoding, so a leftover title sits in the file as the characters of its own hex — and a search for the ordinary spelling finds nothing at all. Four encodings are searched here for that reason. For a second opinion from outside this site entirely, run the downloaded file through PDF to text, or open it in a reader and look at the document properties yourself; a tool that asks you to take its word for the result has skipped the only step that matters.
One case is refused rather than attempted. An encrypted document is not rewritten here, because saving one back out without genuinely decrypting it first can produce a file that claims to be encrypted while its contents are not — and such a file opens nowhere. Removing the password first and the properties second gives you a readable document after each step. If the goal is to circulate less of a document rather than less about it, splitting the PDF and sending three pages is often the better instrument. And the same work on photographs, where the field at stake is usually a coordinate rather than a name, is removing EXIF data.
Questions
Does the document get uploaded?
No. There is no endpoint on this site capable of receiving one. A PDF writing library is fetched from this domain the first time you hand a file in, and it is the same library for everybody; after it lands, nothing further travels. You can watch that happen in the network panel, and the stricter version of the same test is to hand the file in, disconnect the machine, and finish the job anyway. On this particular page the point is sharper than usual, because the properties people want gone are frequently the name of an employee, a client or a case — and the conventional way to delete them begins by transmitting them.
What is actually stored in a PDF besides the pages?
More than most people expect, and it travels everywhere the file goes. There is an information dictionary holding a title, author, subject, keywords, the application that created the document, the software that produced the file, and two timestamps. Producers are free to add keys of their own, and they do — a document written in Word commonly carries a Company field that nobody typed. Then there is usually an XMP packet: the same facts again, expressed as XML, living in a stream that no file manager displays and that survives a tidy-up in the properties dialog of most editors. Every field found is listed for you, by name and value, before anything is removed.
Do the pages change in any way?
No. This is the difference between removing metadata and redacting a document, and it is worth being precise about. Nothing here rebuilds a page, rasterizes anything or re-flows text. The page objects, their fonts, their exact dimensions and their content streams are carried across untouched; what is taken out are the objects that describe the document rather than draw it. Filled form fields keep working, links keep pointing where they pointed, and the text stays selectable and searchable.
Does the output carry any metadata of yours?
None, and it took a deliberate switch to get there. The PDF library used here writes its own producer string and a fresh modification timestamp while saving unless told not to, which would have meant this page quietly signing every file it cleaned — and worse, dating the cleaning. Somebody comparing two copies of a contract would then be able to see that one of them had been through a tool and roughly when, which is information that did not exist before we touched the file. The switch is off. The information dictionary is not merely blanked but removed from the file altogether — an empty one left behind would itself be a small announcement that something used to be there — there is no XMP packet, and nothing in the bytes says the document has been anywhere near this site.
What if the PDF is password protected?
You are told so and pointed at the tool for that job rather than run through this one. The reason is a measured failure rather than caution: writing an encrypted document back out without genuinely decrypting it first can produce a file that claims to be encrypted while its streams are not, and such a file does not open at all in any reader. Removing the password first and the metadata second is two clear steps with a readable file at the end of each.
How do I know the metadata is really gone?
By reading the numbers on the receipt, which come from two independent measurements rather than one repeated twice. The output is opened again and interrogated for properties; that count should be zero. Separately, the finished bytes are swept for the XML signatures a packet begins with and for each value that came out of your document, with no attempt to understand the file as a document at all. Why bother with the second? Because a parser can only miss and report nothing in the same breath, and because of a specific measurement made here: text in a PDF is routinely stored as the hexadecimal spelling of a sixteen-bit encoding, so a surviving title would sit in the file disguised as a run of hex digits. Four spellings are swept for. Anything found is printed rather than summarized.
Can I keep some fields and remove others?
Not field by field, and that is a decision rather than an omission. Somebody looking for this page wants the dictionary empty; a row of eight checkboxes turns a single decision into a form and invites the mistake of leaving one ticked. There is one option, and it exists because it is not really metadata at all: the document language. Screen readers use it to pronounce the text correctly, and sweeping it away would make the file worse for the people who most depend on it, so it is kept unless you say otherwise.
How large a document can this handle?
There is no cap, and refusing on size would be the wrong answer to a question only you can settle — it is your machine. What you get instead is a straight sentence about the demand before the work starts rather than a stalled tab afterwards. Encouragingly, the demand here is modest by the standards of document tooling: not one page is ever drawn, so nothing scales with page count or resolution. The document is parsed, a short list of objects is dropped, and the result is written out, which means the memory in play is close to the file plus one copy of it. A five-hundred-page report is no harder than a two-page letter.