A PDF remembers more than it shows
The failure mode is almost never malice. It is a document that went through internal review and then went outside without anyone thinking about what else travelled with it. The recipient does not have to do anything clever — they open the file and look at its properties.
Five things that ride along
Author, company, creating application, creation and last-modified time.
PDFnoted: Cleared in one pass. Worth checking first because it is the most-read field in the file and the least considered.
Highlights, sticky notes, review comments, tracked changes from an internal pass.
PDFnoted: Annotations are removed while the underlying text stays exactly as it is. This is the single most common thing left in a document by mistake.
Objects not drawn on the page, optional content groups, white-on-white text.
PDFnoted: Detected by parsing the object tree rather than looking at the page — invisible content is, by definition, not visible.
A spreadsheet, a previous draft, or a source file attached inside the PDF.
PDFnoted: Listed before removal so you know what was in there. An earlier version of a contract inside the final one is not a hypothetical.
Draft marks, internal reference numbers, page furniture from a template.
PDFnoted: Vector marks are deleted cleanly; marks baked into a scanned image need reconstruction rather than deletion.
How PDFnoted cleans a document
- Read the file locallyThe document is parsed on your device — a sensitive file is not uploaded before you know what is in it.
- Show what would travelMetadata, comments, hidden objects, attachments and invisible text are listed before anything is removed.
- Remove what you choosePick the categories. Visible content, layout and the text layer stay exactly as they are.
- Verify, then exportThe cleaned file is re-parsed to confirm the objects are actually gone. Success is measured by re-inspection, not by counting operations.
What needs a different tool
✓ Worth doing
- Clear metadata on anything going outside your organisation
- Strip review comments before sending a negotiated document
- Check for embedded attachments on files you did not create
- Verify after cleaning rather than trusting the report
- Use real redaction — remove the content — when content must not be readable
✗ Not worth the risk
- Cover sensitive text with a black rectangle and call it redacted — the text is still there
- Remove the text layer from a scan just to be thorough
- Assume a PDF exported to a new format dropped its metadata — check
- Send a document that went through internal review without looking at its comments
- Flatten a document to "clean" it and lose search and copy
Compared with the usual approaches
| Desktop PDF editor | Typical online cleaner | PDFnoted | |
|---|---|---|---|
| Where the file goes | Local | Uploaded to a server | Your browser |
| Shows what would travel | Sometimes | No | Yes |
| Hidden objects and attachments | Sometimes | Not detected | Yes |
| Comments removed, text untouched | Yes | Sometimes | Yes |
| Verified by re-parsing | No | No | Yes |
| Scanned-mark reconstruction | No | No | AI reconstruction (Pro) |
Frequently asked questions
What kind of hidden data can a PDF contain?
More than most people expect: document properties (author, company, application, creation and edit time), revision history, review comments and annotations, hidden objects and layers, embedded attachments — sometimes a whole earlier draft — invisible text, and metadata left by the generating tool. None of it is visible when you read the document.
How does this actually leak?
Usually by routine. A contract negotiated internally is sent to the counterparty with the internal comments still in the file. A report written by one company is delivered to a client with the previous client's name in the properties. Nothing was stolen; the file simply carried more than the person sending it knew about.
Is removing metadata the same as redaction?
No, and the difference matters. Metadata removal deletes information about the document. Redaction removes visible content — a name, an amount — from the page itself, permanently. Black rectangles drawn over text are not redaction: the text underneath is still in the file and can be recovered. If you need content removed, remove the content, do not cover it.
Can I clean a scanned document?
Yes, though what "cleaning" means differs. A scan carries metadata and sometimes an OCR layer with recognisable words. Visible marks on a scan — stamps, handwriting, baked-in watermarks — are pixels and need reconstruction rather than deletion, which is a different operation.
Will cleaning damage the document?
No. Removal targets the objects you selected; page content, fonts and layout are untouched. PDFnoted re-parses the result afterwards to confirm what was removed is actually gone, rather than reporting success based on how many operations ran.
Does it remove the text layer?
Only if you ask it to. Removing the text layer from a scanned document makes it unsearchable and is almost never what you want, so it is a separate, explicit choice.
Can I clean several documents at once?
Yes. Batch cleanup applies the same policy across a folder — the sensible approach when a team is preparing a set of documents for external delivery.
What should never be sent without cleaning?
Anything that went through internal review: contracts with comments and tracked changes, reports containing client names in their properties, documents carrying embedded earlier drafts, and any file whose author field would tell the recipient something they do not need to know.
Try it on your own file
Upload a document and see what comes back. Free to start, nothing to install.
Clean a document now — free to startKeep going
Sources and further reading: ISO 32000 (PDF specification); Adobe PDF Reference; Schema.org structured data; Aggarwal et al., GEO: Generative Engine Optimization (arXiv:2311.09735). This page is a technical guide, not legal advice.