Remove PDF Metadata Offline — Zero‑Upload Scrubber

field notes

Why the "Delete in 1 Hour" Promise Is a Security Risk

Free online PDF cleaners all advertise the same reassurance: upload your document, and it will be deleted within the hour. That sentence describes a system in which your file is copied to somebody else's hardware, processed by software you cannot inspect, and removed only after a timer you cannot verify. The promise is the product. Everything that happens before the clock runs out is the risk.

An upload means your document exists in at least four places: the inbound buffer, the working directory the converter writes to, the cache or CDN edge that serves the result, and the backup snapshot that nightly jobs recreate. "Deleted in one hour" usually describes only the working copy. Snapshots expire on their own schedule — thirty days is common — and log lines such as 4.2 MB received at 14:07 UTC are rarely purged with the file. Where a service outsources conversion, the document travels a second time to a processor named in a terms-of-service appendix you did not read.

The deeper problem is that a deletion promise is an assertion, not a property. You cannot observe it from outside, and most companies cannot prove afterwards that a particular byte is gone. The threat models you actually care about — an exposed storage bucket, a curious contractor, a subpoena, a ransomware snapshot — all sit precisely in the window the promise does not cover. Scrubbing locally removes the window entirely: the file is read into an ArrayBuffer, rewritten in memory by JavaScript, and handed back as a download. There is no request to intercept because no request is ever made.

What Hidden Data Is Actually in a PDF

People treat a PDF as a picture of a page. It is closer to a database, and two structures in it describe the file rather than the content.

The /Info dictionary

The document trailer points to an /Info dictionary holding /Title, /Author, /Subject, /Keywords, /Creator, /Producer, /CreationDate and /ModDate. /Creator is the application that started the document — Word, LaTeX, InDesign, a scanner utility. /Producer is the library or distiller that finished it, often naming a company and an exact version number. The two dates carry time zones, so they can place a document on a specific afternoon in a specific office. Any custom keys a workflow added live here too, which is why this tool clears every entry left in the dictionary, not just the seven standard ones.

XMP metadata

Modern exporters also write an XMP packet: RDF/XML stored as a /Metadata stream attached to the document catalog. It mirrors the dictionary but can hold far more — software and version, export presets, colour profiles, resolution, camera or scanner model, edit history, sometimes "saved by". Because it is plain XML it is trivially greppable, and because the two copies can disagree, a cleaner that touches only /Info quietly leaves the second copy behind. This scrubber blanks the packet and leaves an empty one in place so the structure stays valid.

What else leaks

Subset font names, embedded attachments, annotation notes and earlier incremental revisions can all carry identifying traces. Read in this order, the fields a stranger sees first are Author, Creator and Producer — exactly the ones this tool removes first.

Who Needs This Tool

Lawyers and paralegals

Filings, discovery bundles and exhibits travel to opposing counsel daily. Metadata discloses drafting software, internal file paths and the paralegal who exported the bundle, and courts increasingly treat an inadvertent metadata disclosure as a competence problem rather than a curiosity. Scrub each exhibit before it leaves the office.

Journalists and their sources

A leaked PDF whose /Author or /CreationDate narrows the document to four people who touched it on one afternoon can endanger the chain behind it. Cleaning the file before publication protects the source, not just the text — and doing it locally means the unpublished draft never sits on a third-party server while you work.

HR, recruiting and consulting

Offer letters, performance reviews and internal memos carry the HRIS or template name in /Creator and a manager's name in /Author. Sending them out intact leaks org structure to the recipient; sending a signed contract out with a stale /ModDate invites arguments about when it was last edited. Researchers and anyone publishing downloadable forms get the same benefit: the document says what it says, and nothing about how it was made.

Related Tools and Reading

• How to Remove Metadata from a PDF — the full field list, every manual removal method, and how to verify a file is actually clean.
• Privacy tools category — every browser-side utility on Daily Utility Lab that keeps data on your device.
• Privacy policy — what we log (nothing), what we store (three small local preferences, not your files), and how the zero-upload claim is enforced.
• Guides — longer write-ups on the numbers and the fine print behind the tools.