PDF metadata explained: Info dictionary and XMP

The older store is the document information dictionary, referenced from the file trailer as /Info. It has a fixed set of keys: Title, Author, Subject, Keywords, Creator (the application that made the original content), Producer (the program that wrote the PDF), CreationDate, ModDate and Trapped. Writers may add their own keys next to them, and some do — build numbers, licence names, internal document IDs.

The newer store is an XMP packet: an XML document in RDF syntax attached to the catalog as /Metadata. It repeats the same facts under namespaces such as dc:creator, xmp:CreateDate, pdf:Producer and adds ones Info never had — xmpMM:DocumentID and InstanceID, which tie versions of a file together, and xmpMM:History, a log of edits with the software agent and timestamp of each. PDF 2.0 steers writers toward XMP, but in practice files carry both, and they do not always agree: a document renamed in one viewer can keep the old title in the other store.

Producer is filled automatically and rarely edited, so it is unusually honest. “Microsoft® Word for Microsoft 365” says the document was exported from Word. “Skia/PDF m124” means Chrome's print engine, and the m-number is the Chromium milestone, which dates the export to a few weeks. “macOS Version 14.4 (Build 23E214) Quartz PDFContext” names the exact operating-system build. “LibreOffice 7.6”, “Acrobat Distiller 21.0 (Windows)”, “iText® 7.1.15”, “wkhtmltopdf 0.12.6” — each one describes a toolchain, and a scanner writes its model name, such as “Canon iR-ADV C5550”.

Creator adds the authoring application (“Writer”, “Word”, “Pages”), and Author is usually copied straight from the source document's properties or from the operating-system account — which is how a PDF “from the company” ends up signed by a personal laptop's user name. Keywords and Subject travel from the source document as well.

PDF dates look like D:20260417093012+03'00'. The last part is the offset from UTC of the machine that saved the file, so a document that claims to come from a London office but carries +03'00' on every date was saved three time zones east. CreationDate and ModDate together show how long a file was worked on, and a ModDate earlier than the sender's email suggests the attachment was prepared some time ago.

Adobe applications go further: every save adds an entry to xmpMM:History with stEvt:action, stEvt:softwareAgent and stEvt:when, and xmp:MetadataDate records the last metadata touch. DocumentID stays constant across versions while InstanceID changes, so two PDFs sent to two parties can be recognised as siblings even after their content diverges.

A PDF page draws images from XObject streams. When the source is a JPEG, many writers store the original file bytes with the DCTDecode filter — img2pdf does this on purpose to stay lossless, and several print-to-PDF paths and scanners do the same. The EXIF block inside those bytes survives, GPS coordinates included, even though no viewer ever shows it. Image XObjects can also carry their own /Metadata packet, which Photoshop and InDesign write when they place a picture.

Metadata cleaners that work on the document level, MetaBroom included, do not open image streams. The safe order is to clean the photos first and build the PDF afterwards, or to re-export the PDF from a clean source. Comments and sticky notes are another content-level trace: each annotation has a /T entry with the author's name and /M with the modification date.

PDF allows a program to save changes by appending new objects and a new cross-reference table to the end of the file instead of rewriting it. The original bytes stay in place; only the pointers move. Acrobat's plain Save, Preview's annotation tools and many form fillers work this way. A file that has been saved incrementally contains the string %%EOF more than once, and everything before the last one is still there: the previous title, a comment that was “deleted”, the text under a black box that was drawn rather than redacted.

The only way to drop those layers is a full rewrite that parses the current objects and writes a fresh file. “Save As” in Acrobat, qpdf, Ghostscript and pdf-lib all do this; MetaBroom's cleaner is built on pdf-lib for exactly that reason and reports the number of incremental updates it found in the original.

For a quick look, pdfinfo from the Poppler tools prints the Info dictionary and page count, and exiftool -a -G1 file.pdf prints both stores with their origin marked. Acrobat shows everything under File → Properties, including the Custom and Additional Metadata tabs; Preview on macOS has Tools → Show Inspector. Dropping the file into MetaBroom lists the Info entries, the XMP fields, annotation authors, application data (PieceInfo), attachments and the count of incremental updates in one panel.

To clean, MetaBroom sets Title, Author, Subject, Keywords, Creator and Producer to empty strings, deletes the dates and any custom Info keys, removes the /Metadata packet and PieceInfo from the catalog and from every page, optionally blanks annotation authors, and saves a complete new file. ExifTool's -all= is convenient but, as its documentation warns, PDF edits made by ExifTool are appended and reversible — the old values remain in the file until it is rewritten by another tool. Acrobat Pro's “Remove Hidden Information” and “Sanitize Document” are thorough and also flatten content. Whatever you use, re-read the result before sending it; MetaBroom does this automatically.