VaultDocs
2 min read

Remove Hidden Data From a PDF Before Sending It

PDFs hide layers, comments, revisions, and metadata. Learn how to find and remove hidden data from a PDF offline before you share it.

A PDF can look clean on screen while still carrying data you never intended to share: hidden layers, tracked comments, earlier revisions, embedded fonts with names, attachments, and metadata. Before sending a document externally, it's worth knowing exactly what's inside and how to strip it — all offline.

Where PDFs hide data

  • Optional content groups (layers) that can be toggled on by the recipient.
  • Annotations and comments, including resolved or hidden ones.
  • Incremental save history — older versions appended to the file.
  • Form field values that persist even when visually overwritten.
  • Attachments embedded inside the PDF.
  • Metadata (author, software, timestamps, XMP).

Step 1: Inspect the file structure

Use qpdf to understand what's inside and to normalize the structure:

qpdf --show-npages document.pdf
qpdf --json document.pdf | less        # inspect objects, annotations, layers

Check metadata and any embedded XMP with ExifTool:

exiftool document.pdf

Step 2: Collapse revisions and layers

Incremental updates store previous content. Rewriting the file discards unreferenced (old) objects:

qpdf --linearize --object-streams=generate document.pdf collapsed.pdf

To remove optional layers and flatten form fields and annotations, flatten with Ghostscript:

gs -sDEVICE=pdfwrite -dNOPAUSE -dBATCH -dSAFER \
   -dPreserveAnnots=false -o flattened.pdf collapsed.pdf

-dPreserveAnnots=false drops annotations/comments; flattening bakes form values into the page.

Step 3: Rasterize if the content is truly sensitive

If you redacted anything, rebuild from images so nothing is recoverable:

magick -density 200 flattened.pdf final.pdf

Step 4: Strip metadata last

exiftool -all:all= final.pdf
rm final.pdf_original

Step 5: Verify

exiftool final.pdf                     # metadata should be clean
pdftotext final.pdf - | less           # confirm no sensitive text remains
qpdf --json final.pdf | grep -i annot  # should show no leftover annotations

Open the file in a different viewer and toggle any "layers" panel to confirm none remain.

Key takeaways

  • PDFs can hide layers, comments, old revisions, form data, attachments, and metadata.
  • qpdf rewrites the file to drop old revisions; Ghostscript flattens layers and annotations.
  • Rasterize when the content is sensitive, then strip metadata as the final step.
  • Always verify structure, text, and metadata before sending.

Treat "looks clean" and "is clean" as different claims — the only way to know is to inspect and strip the hidden layers yourself.

Keep reading