What Hidden Data Lurks in PDFs?
A PDF created from a Word document can quietly retain the original author name, company, edit timestamps, tracked changes, and inline comments — even long after you have saved it as a PDF. Document properties typically include far more than you expect: the author name and organization, creation and modification dates, the exact software used to create it, the full revision history and prior versions, and any comments or annotations that may have been hidden from view. For legal, medical, or business documents, this leftover metadata can become a serious confidentiality risk. Courts have repeatedly seen real cases where supposedly redacted PDFs still contained perfectly readable text hidden beneath simple black boxes.
How to Securely Handle PDFs
- 1Before sharing any PDF, take a moment to inspect its metadata. Open the document properties to see exactly what author name, software details, and revision information are quietly embedded inside the file.
- 2Remove or redact any sensitive content properly and thoroughly. True redaction actually overwrites the underlying text data — never simply draw a black rectangle over the text, because the original text remains fully selectable and searchable underneath it.
- 3Use password protection for any document that contains sensitive information. Set both an open password (required to view the file at all) and a separate permissions password (to prevent copying, printing, or editing the contents).
PDF Security Best Practices
Always use print to PDF from a clean application whenever you need a genuinely metadata-free version of a document, rather than exporting directly from the original source file. For legal redaction, rely on dedicated tools that verifiably overwrite the underlying content, rather than simply layering shapes on top of the text. Be especially cautious with PDFs received from unknown sources — they can contain embedded JavaScript, hyperlinks pointing to tracking URLs, or even exploit code that targets vulnerabilities in your PDF reader. Always check that your PDF reader is fully up to date; PDF reader vulnerabilities remain a remarkably common attack vector.