Remove PDF Metadata
Removes document properties, image EXIF and GPS, annotation authorship, attachments and scripts — then re-reads the finished file and tells you what came out. Add several files to clean them all at once.
Runs on your device. Nothing is uploaded.
Drop a PDF here
PDF · processed on this device
Add several files to clean them all at once.
Clean our test file and watch the report name every value it takes out — the GPS in the photograph, the reviewer on the comment, the spreadsheet riding along inside it.
It tells you what it removed, not how much
“3 properties removed” is a number you have to take on trust. If you came here because you were worried your name was in a file, a count does not answer the question you had. So the result names every value that came out:
| Field | Was | Now |
|---|---|---|
| Author | Jane Doe | removed |
| Producer | SecretWriter 4.2 | removed |
| GPS coordinates (image 1) | 37.441900, −122.143000 | removed |
| Camera (image 1) | TestCam LeakModel-9000 | removed |
| Annotation author (page 1) | Reviewer Bob Smith | removed |
| Embedded file | salary-band.csv (25 B) | removed |
Then it re-opens the finished copy and reads it back the same way the inspector does, because calling delete() on a field is not evidence that it is gone. Anything it could not process is listed with the reason rather than passed over. Why we check our own output.
Why remove PDF metadata?
A document carries more than what is printed on it: who wrote it, when, on which software, who reviewed it, and — if it contains photographs — where those photographs were taken.
Most of that is invisible in a PDF reader, which is exactly why it survives being shared. Cleaning it before a file leaves your organization removes a category of accidental disclosure that is hard to notice after the fact.
What Lyonite removes
- Document properties: Title, Author, Subject, Keywords, Creator, Producer, dates, Trapped, and any custom fields an application added.
- Image EXIF and GPS: Camera make and model, the photographer name, and coordinates, stripped from inside embedded JPEGs.
- Annotation authorship: The name and timestamp on every comment and sticky note. The comments themselves stay.
- Attachments and scripts: Embedded files and JavaScript, with their objects deleted rather than just unlinked.
- XMP and identifiers: Document and page-level XMP, PieceInfo, LastModified, page thumbnails and the trailer document ID.
Who needs this
Legal and business teams
Strip author names, review comments’ authorship, timestamps and internal document properties before a file goes to a counterparty.
Journalists and researchers
A leaked document’s embedded photographs are the usual way a source is narrowed down. This is the case the image handling was built for.
Anyone sharing a document
Proposals, reports and scanned forms all pick up metadata from the tools that made them, and none of it is visible when you read the file.
How the sanitizer works
Written out because the difference between tools in this category is entirely in the details, and none of them publish theirs.
The document layer is the part every tool does. The Document Information dictionary is deleted whole rather than blanked field by field, which is what takes custom entries like Company, Department or SourcePath with it. The XMP packet goes from the catalog and from every page, along with PieceInfo, LastModified and thumbnail entries, and the trailer ID that links revisions of a document to each other.
Embedded images are where a document-level clean stops and the interesting data begins. A JPEG placed in a PDF keeps the metadata it arrived with, so Lyonite walks the image's marker structure and drops the APP1 (EXIF and XMP), APP13 (IPTC) and COM segments, copying every other byte through unchanged. On reaching the start-of-scan marker it copies the remainder verbatim, because that is entropy-coded image data with no segment structure. Nothing is decoded and nothing is re-encoded, so the compressed image comes out bit-identical and the picture is untouched.
Images it cannot read as a JPEG — JPEG 2000, or a JPEG wrapped in a second compression layer — are skipped and reported, with the encoding named. Rewriting them would mean re-compressing and changing how they look, and a corrupted file is worse than an uncleaned one.
Annotations keep their text and lose their authorship: /T the commenter, /M the timestamp, and the rich-text copy that repeats the name. Deleting the annotations themselves would change what the document says, which is not what removing metadata should mean.
Attachments and scripts are deleted, not unlinked. This distinction is the one that catches people, and it caught us: removing the reference to an embedded file or an open-on-load script leaves the object itself in the document, and most PDF libraries write out every object they hold whether or not anything points at it. The attachment ships in the "cleaned" copy, absent from the viewer's attachments pane and entirely recoverable. Lyonite sweeps the object graph for both: every file specification carrying embedded bytes, and every script object. Neither is only looked for in the one place it is usually listed — an attachment can hang off a comment rather than the attachments pane, and a script is more often written inline inside another object than stored as one of its own.
Then it checks its own work. The finished bytes are re-opened and read with the same inspector the Viewer tab uses, and the result panel reports from that rather than from the edits that were made. Claiming a field was removed because we called delete on it is not evidence.
Why verifying manually is harder than it looks: ExifTool run against a PDF reports on the document, not on the images inside it, so a photo full of GPS tags produces no output. qpdf --qdf garbage-collects unreferenced objects while rewriting, so anything unlinked but not deleted vanishes from the expanded output while remaining in the real file. We published the test and the corpus so you do not have to take our word for any of this.
Frequently asked questions
What actually gets removed?
The whole Document Information dictionary, including custom entries such as Company or SourcePath; XMP metadata at document and page level; the trailer document ID; page PieceInfo, LastModified and thumbnail entries; EXIF, GPS and comment blocks inside embedded JPEG images; author names and timestamps on annotations; embedded file attachments; and embedded JavaScript. Attachment and script objects are deleted rather than unlinked, so they do not remain in the file unreferenced.
Does it remove GPS coordinates from photos in the document?
Yes. A photograph placed into a PDF keeps the EXIF block it arrived with, which can include the camera model, the photographer name and the coordinates where it was taken. That data lives inside the image, not in the document properties, so removing document metadata alone leaves it untouched. Lyonite strips those segments from the image itself.
How do I know it worked?
The tool re-opens the file it just produced, reads it with the same inspector the Viewer tab uses, and reports from that rather than from the edits it made. It also lists anything it did not process and why. Checking manually is harder than it looks: ExifTool run against a PDF reports on the document and not on the images inside it, and qpdf --qdf garbage-collects unreferenced objects while rewriting, so both can report a file as clean when it is not.
Is my file uploaded anywhere?
No. The remover runs in your browser, and the page is served with a Content-Security-Policy that permits network connections only back to lyonite.com, so a request carrying your file elsewhere is refused by the browser rather than caught in review.
Can I remove metadata from several PDFs at once?
Yes. Select or drop more than one PDF and the tool runs the identical sweep over every file — up to 50 at a time — and returning them as a single zip. Each file gets its own line saying what was removed from it, and a file that cannot be processed, such as an encrypted one, says so without stopping the rest. It runs in your browser either way, so nothing is uploaded no matter how many files you add.
What stays in the file?
Everything visible on the page: text, images, and the text of comments and sticky notes, whose authors and timestamps are removed but whose content is not. Form field values stay. A black rectangle drawn over text is not a redaction and the text underneath remains selectable. Removing metadata does not make a document anonymous.
Are any images skipped?
Images in encodings that cannot be rewritten without re-compressing them — JPEG 2000, or a JPEG wrapped in a second compression layer — are reported as skipped, with the reason, rather than altered. Re-compressing would change how the picture looks, and a corrupted file is worse than an uncleaned one.
What happens to a digital signature?
Saving a cleaned copy rewrites the file, so an existing digital signature will no longer validate. A signature field may still be present, but it cannot remain a valid signature of the original bytes. If you need the signature to survive, work from an unsigned copy.
Can it clean an encrypted or password-protected PDF?
No. Lyonite blocks encrypted files because the PDF engine it uses does not decrypt them and cannot safely rewrite them. Remove the password from a file you are authorized to access, then clean the decrypted copy.
If your PDF is signed
Do not clean a file whose signature has to stay valid. Work from an unsigned copy instead.
Legal and ethical use
This tool exists for legitimate privacy protection. Please review our Terms of Service. Removing metadata does not erase visible content and does not make a document anonymous.