How to Check a PDF for Hidden Metadata

What counts as hidden metadata in a PDF?

PDF files are containers. Beyond the visible text and images, they store structured data that most users never see. This metadata falls into several categories:

Document properties — Author name, creation software, company name, creation and modification timestamps, title, subject, keywords.

XMP metadata — An XML-based format embedded in the PDF that can duplicate document properties but also store extended information like edit history, contributor names, and software version strings.

Embedded files and attachments — PDFs can contain other files (spreadsheets, images, other PDFs) that aren't rendered on any page but travel with the document.

Incremental saves — PDFs support non-destructive editing. When you "delete" content, the original data may remain in the file, recoverable with the right tools.

Image EXIF data — Photos embedded in PDFs often retain their original metadata: camera model, GPS coordinates, timestamps, even thumbnail previews of the original uncropped image.

JavaScript, forms, and annotations — Comments, form field data, and scripts can persist invisibly.

Font subsets and producer strings — These reveal which fonts were installed on the creator's system and which software generated the file.

Any of these can leak sensitive information. A legal filing might expose the paralegal's home directory path. A redacted report might contain the original text in an incremental save. A photo in a real estate document might reveal the agent's home address via GPS coordinates.

Why you should inspect before sharing

The risk isn't theoretical. Court cases have been compromised by metadata revealing negotiation positions. Journalists have been identified through document properties. Whistleblowers have been traced via embedded timestamps and software fingerprints.

Before sharing any PDF externally—especially one containing sensitive information—you need to know exactly what's in it. This is doubly important if you've performed redactions: naive redaction methods (black boxes over text, for instance) often leave the underlying content intact and searchable. Our guide on Why Black Highlighter Redaction Fails to Secure PDFs covers this failure mode in detail.

Inspecting metadata with exiftool (cross-platform)

ExifTool is the gold standard for metadata inspection. It's free, open-source, runs entirely offline, and handles PDFs alongside images and dozens of other formats.

Installation

macOS (Homebrew):

brew install exiftool

Linux (Debian/Ubuntu):

sudo apt install libimage-exiftool-perl

Windows: Download the standalone executable from exiftool.org. No installation required—just extract and run from the command line.

Basic inspection

exiftool document.pdf

This outputs all readable metadata. Look for fields like:

• Author
• Creator (the application used)
• Producer (the PDF library)
• Create Date / Modify Date
• Title, Subject, Keywords
• PDF Version

Deep inspection

For a more thorough view, including XMP data and embedded structures:

exiftool -a -G1 -s document.pdf

The -a flag shows duplicate tags, -G1 groups them by source (PDF, XMP, etc.), and -s uses short tag names for cleaner output.

Extracting embedded XMP

exiftool -xmp -b document.pdf > metadata.xmp

This dumps the raw XMP block to a file you can inspect with any text editor.

Checking for embedded files and attachments

PDFs can carry attachments that don't appear on any page. Use pdfdetach (part of Poppler utilities) to list and extract them:

pdfdetach -list document.pdf

If attachments exist, extract them for inspection:

pdfdetach -saveall document.pdf

On macOS, install Poppler via brew install poppler. On Linux, it's typically sudo apt install poppler-utils.

Inspecting incremental saves and hidden content

PDFs edited multiple times may contain previous versions of content. The qpdf tool can help identify structural anomalies:

qpdf --check document.pdf

For a detailed object-level view:

qpdf --show-object=all document.pdf

This is advanced territory, but if you see objects that don't correspond to visible page content, investigate further. The guide on How to Permanently Delete Text From a PDF explains how to flatten these layers.

To decompress streams for manual inspection:

qpdf --qdf --object-streams=disable document.pdf readable.pdf

The output file is human-readable in a text editor. Search for strings that shouldn't be there—names, addresses, text you thought you deleted.

Checking embedded images for EXIF data

Images inside PDFs retain their original metadata unless explicitly stripped. First, extract all images:

pdfimages -all document.pdf ./extracted/image

Then inspect each image:

exiftool extracted/*

Look for GPS coordinates (GPSLatitude, GPSLongitude), camera serial numbers, timestamps, and thumbnail images that might show content cropped from the final version.

Using mat2 for comprehensive analysis

MAT2 (Metadata Anonymisation Toolkit 2) is designed specifically for metadata removal, but its inspection mode is equally useful:

mat2 --show document.pdf

This provides a consolidated view of all metadata mat2 can detect and remove. It's particularly good at catching metadata that other tools might categorize differently.

Install on Linux:

sudo apt install mat2

On macOS:

brew install mat2

GUI options for non-command-line users

Adobe Acrobat Pro — File → Properties shows document metadata. File → Save As Other → Optimized PDF → Audit Space Usage reveals embedded content. The "Remove Hidden Information" tool under Protection provides a pre-sharing scan.

PDF-XChange Editor (Windows) — Document → Properties → Metadata. Also shows attachments, comments, and form data in the left panel.

Preview (macOS) — Tools → Show Inspector → Info tab. Limited compared to command-line tools but catches basic document properties.

For thorough inspection, command-line tools remain superior. GUI applications often hide metadata they don't consider "relevant."

Verify your work

After inspecting (and potentially cleaning) a PDF, verify the result:

1. Re-run exiftool on the cleaned file. Confirm sensitive fields are gone or replaced with generic values.

2. Check file size. A dramatic size reduction after cleaning suggests embedded content was removed. A file that stays the same size after "removing" metadata may not have been properly cleaned.

3. Open in a text editor. PDFs are partially human-readable. Search for names, email addresses, or paths that shouldn't be there.

4. Extract and inspect images again. Confirm EXIF data is stripped.

5. Test with multiple tools. What exiftool misses, mat2 might catch, and vice versa.

Our Free Local PDF Metadata Scrubber: A Complete Guide walks through the removal process once you've identified what needs to go.

Key takeaways

• PDF metadata extends far beyond "document properties"—check for XMP data, embedded files, incremental saves, and image EXIF.
• ExifTool is the most comprehensive offline inspection tool. Learn its flags.
• Use pdfdetach to find hidden attachments and pdfimages to extract embedded images for separate EXIF inspection.
• Decompress PDFs with qpdf for manual text searches when you suspect hidden content.
• Always verify after cleaning. Run the same inspection tools on your output file.
• Never trust a single tool. Cross-check with exiftool, mat2, and manual inspection for sensitive documents.

Related guides

• How to Redact a PDF Offline on a Mac (Securely)
• How to Permanently Delete Text From a PDF
• Remove Hidden Data From a PDF Before Sending It