Remove metadata from PDF documents

PDF contents beyond the page

PDFs can carry document properties, object-level XMP, custom properties and older revision objects beyond the visible page. Comments, form values, attachments and active actions are separate containers to assess. Read those findings together before disclosure; a blank author property does not establish that every object or attachment was reviewed.

• Info dictionary, document/object XMP and custom properties
• Annotation and form fields
• Attachments, associated files, actions/JavaScript, revisions, signatures and encryption

Changes during PDF processing

The supported path removes assessed document information, XMP and privacy-bearing objects, then independently checks the rewritten file. Reported form values, annotations, attachments or active content can also be removed. Treat those as changes to the document, read the report and open the output before the accountable person authorises release.

Rewritten PDF structure and signature limits

The assessed output must retain the page and document structures needed for the supported result. Rewriting does not preserve the cryptographic validity of a digital signature or C2PA credential. Keep the original when those records matter, then inspect the processed pages and content-removal findings before deciding how to use the copy.

• The supported page and document structures required by the rewritten output.

PDF processing and disclosure limits

Encrypted or password-protected PDFs are refused on this path; decrypt a copy locally before processing it. A request to preserve cryptographic credentials also fails. Metadata verification does not redact every personal detail in page text or images, so disclosure scope and visible-content review remain decisions for the responsible people.

• Encrypted or password-protected PDFs are refused; decrypt a copy locally before processing it.
• Rewriting cannot preserve the cryptographic validity of digital signatures or C2PA credentials; a request to preserve them fails.
• Form values, annotations, attachments, active content and older objects can be removed.
• Visible page text and images require their own disclosure review; this workflow does not redact all personal data.