What hidden data can a PDF contain?

Quite a lot. Besides what shows on the page, a PDF can carry document details, XMP metadata, attached files, comments, form fields, invisible text, content off the page, bookmarks, scripts and actions, links, and earlier versions of itself. PDF by Zaweba lists all of these with counts under Protect, Remove hidden information, so you can see what a file holds before you send it. The app is free and works offline on Windows.

None of this is sinister in itself. Most of it gets there through normal use. It's just easy to forget.

The kinds of hidden data

Document details are the title, author, subject and keywords. The author is often whoever set up the computer or the template, which may not be who you'd expect.

XMP is a richer metadata store, usually written by the program that made the file. It can name the software and carry other properties.

Attached files are whole files tucked inside the PDF. Comments include notes, highlights and replies, some of which may be hidden from view.

Form fields can hold values, including in fields you didn't notice.

Invisible text is text that is there but not drawn, as happens when a scan has had text recognition, or when someone has hidden words on purpose. Content off the page sits outside the visible area, often left over from cropping.

Bookmarks and links can reveal working titles and internal addresses. Scripts and actions are instructions the file can carry. PDF by Zaweba never runs scripts or media, but the person you send the file to may use a reader that does.

Earlier versions are the surprise for most people. Ordinary PDF saves are incremental: changes are added to the end of the file, and the older state stays inside. Text you deleted may still be there.

How to see what a file holds

Open the document and choose Protect, Remove hidden information. The list shows each kind with a count. That alone answers the question for that file.

For earlier versions, File, Earlier versions opens each incremental save in a tab of its own, so you can look at exactly what was there before. Document properties (Ctrl+D) shows the details and can list the fonts, with whether each is embedded. File, Additional metadata (XMP) lists every XMP property.

Removing it

In the same window, tick what to remove and save as a new file. Sanitise document removes everything on the list at once. If something on the visible page is sensitive too, redact it first, then remove hidden information, so an earlier version doesn't keep the text you just removed.

When to bother

Check before sending anything outside your organisation, publishing a file on a website, or answering a request for documents. Check files that have been through many hands, such as contracts that went back and forth. For routine use, Tools, Actions has a built-in Prepare for distribution action that bundles these steps.

PDF by Zaweba does the looking and the cleaning on your own computer, so the file isn't shared with anyone in the process.