What a PDF can carry without you knowing
A PDF is more than its pages. The format lets producers attach a surprising amount of extra information to a document, and almost none of it is visible when you open the file or attach it to an email:
- Author names and usernames — from the “Author” field to Windows and macOS file paths baked into the producing software’s strings.
- Software fingerprints — the Creator and Producer fields name the exact application, version and platform that made the file.
- Timestamps — creation and modification times, and XMP metadata dates that can reveal a document’s whole working history.
- Embedded files — whole attachments packed inside the PDF, extractable by any reader.
- Links — including campaign and tracking URLs added by the sender’s tools.
- JavaScript — scripts that can run the moment the file opens.
- Annotations — comments, highlights and stamps that carry their own author and timestamps.
- Hidden objects — layers switched off by default, invisible text, and objects nothing references any more.
- Document history — XMP edit logs, persistent document IDs, and earlier saved revisions.
Individually these look harmless. Together they can identify who wrote a document, on what machine, with which software, and when — and, after a careless “redaction”, still contain the very text that was supposed to be removed.
Why the analysis has to happen locally
The documents worth checking are exactly the ones you should not hand to a stranger’s server: contracts, HR files, medical and legal paperwork, anything under NDA. Most “free PDF metadata remover” sites upload your file to inspect it — which means the document, and all of the sensitive metadata you were trying to find, passes through someone else’s infrastructure first. localdobe reads the file inside your browser tab. Nothing is transmitted, and the clean copy is produced on your device too.
That matters more for this tool than for any other: the whole point is trusting the thing that inspects your private file. There is no server to trust here — you can disconnect from the internet after the page has loaded and everything still works. For the wider picture, read what actually happens to your files on online PDF tools.
What the clean copy changes — and what it leaves alone
“Clean & download” rewrites the PDF from its current pages. Standard document properties, XMP metadata, file identifiers, earlier saved revisions and unreferenced leftovers are gone; scripts and embedded files can be removed with a click. What stays is the document itself: every page renders exactly as before, and links and annotations are untouched.
Because the output is a new file, a digital signature on the original will not validate against it. If the PDF is signed and you need the signature to survive, check its evidence with the signature tool first and do not send a cleaned copy. Once the file is clean, you can lock it down with AES-256 encryption — and if the PDF asks for a password you already know, unlock it before checking.
Frequently asked questions
How do I see what metadata a PDF contains?
Drop the PDF into the checker above. It reads the file on your device and lists everything it carries: author and company fields, the software that made it, creation and edit times, custom fields, XMP metadata, document IDs, embedded files, links, scripts and annotations.
How do I remove metadata from a PDF before sending it?
After the check, click “Clean & download”. The clean copy is rewritten from the document’s current pages with author, software, timestamps, custom fields, XMP, file IDs, earlier saved revisions and leftover objects removed. Page content and links are left alone.
Can a PDF contain hidden data even after you delete something?
Yes — and it is the most under-appreciated PDF risk. PDFs save changes by appending, so when a tool deletes or “redacts” text, the earlier revision usually remains in the file and can be recovered with a recovery tool. The checker counts the saved revisions and the clean copy drops all of them.
Is it safe to open a PDF that contains JavaScript?
Not automatically. PDFs can carry embedded scripts, and some run the moment the file opens. Real-world PDF malware has used exactly this path. If the checker reports JavaScript, only open or forward the file if you trust where it came from; the clean copy can strip the scripts.
What do the Creator and Producer fields reveal?
Creator and Producer name the exact application — and often the version and platform — that produced the file, such as a specific Word or InDesign release, a scanner driver, or a print-to-PDF pipeline. They are a software fingerprint of the machine and workflow behind the document.
Does checking a PDF upload it anywhere?
No. The scan and the clean copy both run entirely in your browser tab. Nothing is transmitted, logged or stored — you can verify it by disconnecting from the internet after the page loads.
Does removing metadata break the PDF?
No. The clean copy keeps every page exactly as it is — text, images, links and annotations included. Only document properties, identifiers, scripts you chose to remove, and data that was not part of the visible document are dropped. A digital signature, however, will no longer validate after cleaning, because the signed bytes changed.