PDF Metadata Viewer

Every PDF carries a small block of metadata that almost nobody notices. Title, Author, Subject, Keywords, Creator (the app that wrote the document), Producer (the export tool), Creation Date, Modification Date. PDF viewers tuck these behind a Properties menu most users never open. Authoring apps populate them automatically — Microsoft Word fills in your name as Author and your Word version as Creator without asking. When you save a Word document as PDF and email it, your name goes with it, embedded in the file.

For business documents this is usually fine. For documents you're sharing publicly — a whistleblower's report, an academic paper submission, a contract you don't want the recipient to know which exact employee drafted — the metadata is a privacy hole. The Vox 2015 piece on metadata-leaked authorship of a TPP analysis is the canonical example: a "leaked" document was attributed to its true source within hours because the Word metadata named the user account, which named the law firm, which named the individual.

This tool does two things. **Read**: shows you exactly what metadata is in the PDF, in a clean table, so you know what's there before you share. **Strip**: rewrites every field to empty and re-saves the PDF. The actual content (text, images, layout, signatures) is preserved bit-for-bit. Only the metadata header changes.

The metadata fields, in practice:

- **Title** — what the document is named in the PDF's own header (often different from the filename). Sometimes set manually, sometimes auto-derived from the first heading. - **Author** — usually the OS account name of the person who created the file. Microsoft Word, LibreOffice, and Pages all default to this. - **Subject** — a one-liner description. Almost never populated by default. - **Keywords** — comma-separated tags. Almost never populated unless someone deliberately set them in the authoring app. - **Creator** — the app that authored the source document. `Microsoft® Word for Microsoft 365`, `LaTeX with hyperref`, `LibreOffice 7.5`, etc. - **Producer** — the tool that exported the source document to PDF. Often a separate library from the Creator. `Acrobat Distiller`, `Microsoft® Word for Microsoft 365`, `xdvipdfmx`, `Skia/PDF`. - **Creation Date** — when the PDF was first generated. - **Modification Date** — when the PDF was last edited (in tools that support PDF editing).

The strip operation sets all eight to empty / epoch. The result is a PDF whose metadata reveals nothing about who made it. A recipient who opens Properties sees blank rows; a forensic analyst who runs `exiftool` sees the same. The PDF version itself is still visible (1.4, 1.7, 2.0), and the embedded font names may still hint at the authoring environment, but the immediate human-readable identifiers are gone.

**Limitations worth knowing.** Stripping the standard metadata doesn't anonymize the PDF completely. Possible residual signals:

- **Embedded fonts**: PDFs include subsets of every font used. The font names may indicate the authoring OS (system fonts like `Calibri` are Windows; `Helvetica Neue` is macOS) or the authoring app (`CMUNRM` is LaTeX's Computer Modern Roman). - **PDF version**: PDF 1.4 was the standard for early-2000s authoring tools; PDF 1.7 is current Office defaults; PDF 2.0 is newer apps. The version itself is a coarse fingerprint. - **Layout fingerprints**: subtle pixel-positioning differences can identify the rendering engine (Skia vs Acrobat vs Quartz) and sometimes the OS. - **XMP metadata packets**: some PDFs embed a verbose XMP metadata block that duplicates the standard fields. This tool only modifies the standard fields; the XMP block (if present) is unchanged. For complete metadata removal, you'd need a tool that rewrites both. (`exiftool -all=` is the command-line option.)

For most purposes, stripping the standard fields is enough — the recipient who opens Properties sees nothing, and casual scrapers see nothing. For high-stakes anonymity (whistleblowing, legal document drops), the additional steps in the limitations above are worth taking.

**Encrypted PDFs.** Password-protected PDFs can't be modified without decryption first. pdf-lib doesn't decrypt in-browser. If your PDF is encrypted, decrypt it externally (Adobe Reader's Properties → Security tab → Save As without security) and then run the unencrypted version through this tool.

**Privacy.** This is a privacy tool, so the no-network promise is the whole point. pdf-lib runs as JavaScript in your tab. The PDF is read into memory via `File.arrayBuffer()`, parsed by pdf-lib, displayed in the table, optionally rewritten with cleared metadata, and downloaded locally via blob URL. The file never leaves your browser. Verify in DevTools — the network panel stays empty during operation.

**Edge cases handled:** PDFs with no metadata set (all fields show "not set"); PDFs with very long titles or keywords (table cells scroll); PDFs with malformed dates (parsed as epoch, displayed as 1970); PDFs that pdf-lib can't parse (clear error with the parser's complaint); blob URL lifecycle properly managed on unmount.