The page preview is only part of the file
You open a PDF, read its pages and see nothing unusual. Its Author field is blank. That tells you what the page looks like and what one field says. It does not tell you everything the file contains.
A PDF can carry a reviewer’s name in a comment, location data in a photo, an attached spreadsheet or an earlier saved copy. None requires a visible line saying “this information is here”. Some is ordinary, useful document data. Some may be information you would rather not share.
The useful question is not whether a PDF has “secret metadata”. It is which parts you need to inspect for the job in front of you.
Metadata describes something; it is not everything hidden
Document metadata includes fields such as Title, Author, dates and software names. PDFs commonly store it in a properties record called the Info dictionary and an additional record called XMP. Both can describe the same document and still disagree.
Metadata can also describe a smaller part of the file. A photograph may retain camera details or GPS coordinates. A comment may record a name and date. The software creating the PDF may preserve or discard these details, so their presence varies.
Attachments and scripts are different: they are contents or instructions stored in the PDF. PDF objects are the building blocks that hold things such as pages, fonts, images and metadata. An object is not automatically metadata, and finding an unfamiliar object is not evidence of concealment.
Start with what PDF metadata means if you want the field names explained. Use the hidden-information guide to inspect comments, photos and attachments in an actual file.
An example: the current author is not the earlier author
Our public sample PDF is deliberately constructed for testing. It contains six retained file states, changes to document properties, JavaScript actions and an unreferenced XMP record. It is not a discovered leak or evidence about a real person.
In its current properties, the title is “Final” and the author is “Priya Raman”. An earlier version records “Draft one” and “Jane Doe”. A tool that mixes records from different saves can give a confident-looking answer to the wrong question.
To follow the example, open the sample in the PDF Metadata Checker. Read Summary, then choose Saved versions. Select an earlier version and choose Read version properties. The earlier values belong to that version; they do not replace the current author.
The same fixture underpins our comparison of PDF inspection tools. That article reports individual observations and limitations. Here, the lesson is simpler: before interpreting a value, know which part and which version of the file supplied it.
PDF edit history is whatever this copy kept
Some PDF saves append changes to the existing file. Earlier data can remain, and a checker can follow the links between saved states. Other operations rewrite the file and may leave no earlier version to recover.
Six stored versions therefore means six retained file states. It does not mean six human edits. One save can change many pages; a routine signing operation can add another state. One retained version does not prove a file has never been edited.
Use the saved-versions guide to inspect a retained copy. If you already have two separate drafts, compare the PDFs instead of hoping one contains the other.
Invisible text can be useful—or worth checking
A scanned PDF may contain an invisible text layer so you can search or copy its words. Text can also be transparent, outside the page or overlapped by other content. Those conditions have ordinary explanations, so a count of “hidden text” is not a fraud finding.
A rectangle drawn over a name is a separate problem: it may cover text without removing the text underneath. Reading extracted text can reveal some such mistakes, but it is not a complete redaction audit. Text rendered only as an image needs a different check, and Lyonite does not run OCR in this workflow.
Read the page-text guide to understand the results and which pages were checked. For two copies, page previews and extracted text answer different questions; review both when a difference matters.
Choose the check that matches your task
- Before sharing: check names in properties and comments, photo metadata and attachments. If you clean a copy, inspect the result and anything the remover skipped. Read the pages too.
- Reviewing a received PDF: keep current properties separate from earlier records. Metadata can be edited; it cannot establish the document’s whole history or who wrote it.
- Checking a signature: use the signature guide. A matching signature checks signed bytes. Certificate trust, signer identity and later changes are separate questions.
- Investigating a technical inconsistency: open PDF objects, XMP and raw bytes. Unreferenced data is still stored in the file, but its presence alone does not explain how it got there.
- Keeping a record: download an inspection report with the completed checks and their limits. A report is not a certificate of authenticity.
You do not need to learn the PDF specification to start. Read the common properties, follow the result relevant to your task, and go deeper when the evidence calls for it.