Every PDF carries information you did not write
Alongside the visible page content, a PDF holds a small set of fields describing the document itself: a title, an author, a subject, keywords, the application it was created in and the software that wrote the file. Most of it is filled in automatically, by software, using whatever it had to hand.
Which is how a document ends up claiming to be authored by a colleague who left three years ago, or titled with the filename of the template it was built from, or subtitled "Microsoft Word - proposal-FINAL-v4-actually-final.docx". Nobody typed any of that. It came from the environment.
Where it shows up
People assume metadata is invisible because they do not look at it. Plenty of things do.
- The title field, not the filename, is what many PDF readers show in the window and tab bar.
- Search engines read it. A PDF indexed from your site can appear in results under its metadata title rather than under anything on the page.
- Document management systems, intranets and file browsers list and sort by author and title.
- The properties panel of any PDF reader shows the lot, one keystroke away.
So the fields are worth setting deliberately on anything published, and worth checking on anything sent outside the organisation.
What it can give away
The author field is the usual culprit. It is typically taken from the licence details of whichever copy of Word or InDesign produced the file, so it names a person, and often a person who has nothing to do with the document you are sending.
The creator and producer strings name software and versions, which tells a reader what you use and how current it is. The dates record when the file was made and last modified, which can contradict a story about when work was done. And a document built from a template frequently inherits the template's title, keywords and author wholesale.
None of this is dramatic on its own. It has been decisive often enough — in litigation, in journalism, in more than one anonymous leak traced back to an author field — to be worth thirty seconds before a file leaves the building.
Reading before writing
Editing metadata means editing what is already there, which is why the [msm_tool slug="pdf-metadata"] reads a document's existing fields on selection and fills them in for you.
Typing into empty boxes is how a producer string that mattered gets silently replaced, or how a carefully set title is overwritten with something slightly different. Look at what the file already claims, change the fields that are wrong, and leave the rest.
Setting the fields well
Title should be the document's real name in plain language, the way you would say it aloud. "Q3 Financial Report 2026", not the filename and not a slug. This is the single field most worth setting, because it is the one most widely displayed.
Author should be whoever should be credited — frequently the organisation rather than an individual. For anything published, an organisation name is usually the right answer and avoids the leaver problem entirely.
Subject is a one-line description. Keywords are a short comma-separated list, and they are worth setting for internal search systems, though they carry no weight with search engines and have not for a long time.
Stripping it
For anything going outside the organisation, clearing the fields is often the safer default. The document says what it says on the page; the metadata usually adds nothing you intended and occasionally adds something you did not.
Two limits to understand before relying on it. First, clearing the visible fields does not touch anything on the page — a name in the text of the document is still in the text of the document, and metadata is not where content lives. Second, PDF can also carry XMP, a second and richer metadata block, and some producers write information into both. A tool that clears the document information dictionary handles the fields that readers and file browsers display, which is the common case, and is not a guarantee that nothing whatsoever remains embedded in a complex file.
If a document's provenance genuinely has to be untraceable, the reliable route is to rebuild it: export a fresh PDF from a clean source in a clean environment, rather than sanitising an existing file and hoping.
A habit worth having
Check the properties panel of any PDF before you publish it, and again on any PDF you receive that you are about to forward. It takes seconds, it catches the leaver's name and the template's title before anyone else sees them, and on a received file it occasionally tells you something useful about where the document actually came from.