What your PDF reveals without asking you
You export a contract, email it off, done deal. Yet the file you just sent may contain the author’s name, the exact creation date, the software used, a revision history in XMP — even an embedded attachment forgotten three versions ago. One click on “Document Properties” in any PDF reader is enough to read it all.
Good news: these traces are internal file structures, separate from the visible content. They can be removed cleanly, locally, without rewriting a single page. You just need to know what “cleaning” means — because three different problems are often conflated.
Three problems, three tools
Before processing a PDF, identify what you actually want to remove:
- Structural cleanup — metadata, automatic scripts, embedded attachments, annotations. That is what Sanitize a PDF does. Page text and images stay untouched.
- Content anonymization — hiding what is visible on screen: a name, an IBAN, a case number. Cleanup does not touch page content; you need redaction, like Redact data from a PDF, which rasterizes the masked areas.
- Access control — preventing anyone without the password from opening the file. That is encryption’s job, via Protect a PDF.
A structurally “clean” document can therefore remain perfectly identifiable by its content — and conversely, a redacted PDF keeps its metadata if you do not remove it. The three operations are complementary, not interchangeable.
What cleanup actually removes
The Sanitize a PDF tool offers four options, each mapping to a family of file structures. By default, anything that leaks data or runs code is checked; annotations, which are part of the visible content, are left to your choice.
Metadata (title, author, dates, XMP)
Removal targets the PDF’s Info dictionary: Title, Author, Subject, Keywords, Creator, Producer, CreationDate and ModDate. The catalog’s XMP metadata stream is also deleted — that is the one that can hold a detailed, version-by-version revision history.
JavaScript and automatic actions
A PDF can run code: OpenAction actions at startup, AA triggers at document, page, annotation or form-field level, Launch actions that start an external program. Cleanup removes the JavaScript entry from the Names dictionary, the catalog’s OpenAction/AA, and every AA trigger on pages, annotations and the form. JavaScript or Launch-type A actions on annotations are also cleared — navigation actions (GoTo, URI links), on the other hand, are kept: they only jump to a page or a site.
Embedded attachments
Embedded files — a source spreadsheet, a draft, an internal appendix — are referenced by the EmbeddedFiles entry in the Names dictionary and the catalog’s AF (associated files) array. Cleanup removes both and counts the attachments removed.
Non-widget annotations (optional)
Comments, highlights, stamps and notes can reveal internal exchanges. The “Annotations” option removes every annotation except form widgets — those are kept so fillable forms do not break. It is the only option unchecked by default: annotations are part of the visible content, and removing them can change the document’s meaning.
When processing finishes, a report shows the number of items actually removed. If no option is checked, the tool refuses to produce a file — an identical copy would be misleading.
What cleanup does not do
Let us be clear about scope — it is the most common mistake:
- Visible text is untouched. Your name in the document body, a client number in a table: everything stays. For that data, use redaction, which destroys the text under the masked areas (see our detailed article: redacting a PDF).
- File access is not restricted. A cleaned PDF opens freely. If the document is confidential, add a password with Protect a PDF — read our article on PDF encryption.
- The source file is not modified. Processing produces a new file downloaded as
…-sanitized.pdf; the original stays intact on your device.
The recommended workflow before sending
For a sensitive document, order matters:
- Clean first with Sanitize a PDF: metadata, scripts, attachments — and annotations if needed. It is the lossless step, so it must run on the final document.
- Redact next if visible content must disappear: censored pages are rasterized, which freezes the document.
- Protect last with a password if access must be controlled: encryption locks the file as it stands.
The whole chain runs in your browser, with nothing sent to a server — a central point for compliance, detailed in our article on GDPR and local PDF processing and our guide on local PDF privacy.
Limits and pitfalls
- Size and pagination. The tool accepts a file up to 50 MiB and 1,000 pages, like the other PDF tools in the catalog.
- Encrypted or corrupted PDFs. A password-protected or damaged file cannot be opened for cleanup; unlock it first.
- A clean PDF is not an anonymous PDF. If your name appears in the content, cleanup will not remove it — proofread the document after processing.
- Visible annotations stay by default. If your reviewer left signed comments, remember to check the “Annotations” option.
- Verify the result. Reopen the cleaned file and display its properties: the fields must be empty. That is the only check that matters.
