Guide · 7 min read
How to Check a PDF Is Really Private Before Sharing It
See what a PDF reveals before you send it: document properties, hidden image data, password realities, and a pre-share checklist.
Last updated: 2026-10-03
Tools for this guide
Read the document properties first
Every PDF carries a small dossier about itself, and most senders never look at it. Drop the file into the PDF Page Counter and analysis runs immediately — no button, no upload — reporting the page count, the exact file size, and a status badge with the PDF version. Below that, a details table lists the revealing fields when present: title, author, the creating application, the producing software, and the page sizes grouped by dimension so mixed-orientation documents show up at a glance.
Each field tells its own story. Author may hold your full name from the office suite's registration; creator and producer name the software chain that built the file, from word processor to PDF library; title sometimes preserves a working draft name you would rather forget. When title or author data is present alongside a filename, the tool raises an explicit warning banner suggesting a re-save before public sharing — treat that banner as a mandatory review step, not decoration.
Two edge cases deserve mention. Password-protected files cannot be inspected at all: the tool reports plainly that properties can't be read without the password, which is itself useful knowledge — anything you cannot see, you cannot vouch for. And a clean report (no title, no author) still covers only document-level fields; the images embedded inside carry their own separate metadata, which the next sections address.
Learn why re-saving changes what others can see
A PDF is not a sealed envelope — every save rewrites structural stamps such as the producer string and version, and any operation that rebuilds the file gives you a fresh metadata surface to verify. Compression is the most useful rebuild available here: the Smart engine recompresses embedded images in a worker while leaving text and vectors untouched, so extracted word counts come back identical before and after. Measured runs show what to expect: scanned pages saved 58.6%, photo-heavy pages 77.8%, mixed text-and-image pages 71.4%, and one large photo page 96.7%, each processed in 0.3 to 2.1 seconds.
The honest counterpart matters equally: text-only files saved 0% because there was nothing wasteful to remove, returning byte-identical output. Byte-identical means nothing changed — including metadata fields — so compression is not a cleaning step for text-native documents. Files that were already efficient behave the same way. Knowing which category your file falls into stops both false confidence and wasted effort.
Turn this into a verify-twice routine: inspect the original and screenshot or note its fields, run compression, then inspect the result and compare. If author or title survived the rebuild, that is a fact you now know rather than a leak you discover from a recipient. The comparison takes a minute and converts assumptions about the file into observations of it.
Check the photos buried inside the document
Document properties are only half the surface. Photos embedded in a PDF — scanned pages, product shots, site-visit pictures — can carry their own EXIF baggage: GPS coordinates, capture timestamps, device models, and thumbnail previews, all invisible in normal viewing and untouched by document-level inspection. A contract that looks clean in the properties table can still broadcast where and when its evidence photos were taken.
The durable fix happens before the PDF is built: clean the source images first. The Image Metadata Remover re-encodes each picture with the browser's own encoder at quality 94, which writes fresh pixel data only — EXIF, GPS, camera info, and embedded thumbnails are dropped by construction rather than hunted individually. Each image keeps its original format, downloads gain a -clean suffix, batches of up to 10 files are supported, and originals are never modified, so the archive stays intact while the sharing copies go out sanitized.
Respect the boundary of what stripping achieves: it removes data about the photo, never content within it. Faces, license plates, house numbers, and whiteboard text visible in the pixels survive untouched — those need cropping, blurring, or re-shooting before the image enters any document. Metadata hygiene and visual redaction are complementary chores; performing only one leaves the other exposed.
Treat passwords as locks, not invisibility
Passwords control access; they sanitize nothing. A password-protected PDF still contains its full text, images, EXIF data, and metadata — encryption merely bars the door until the password arrives. Anyone you share both file and password with sees everything a passwordless recipient would see, so sending the password in the same email as the file reduces protection to a single forwarded message. Use a separate channel for credentials, and rotate passwords that have traveled too widely.
Related confusion surrounds redaction: drawing black rectangles over text in an editor hides it visually while leaving every character in the file, recoverable by copy-paste or text extraction. True removal means the content is absent from the saved file — for whole pages, deleting them into a freshly built document that contains only kept pages achieves this structurally, since uncopied pages simply do not exist downstream. For partial redaction within a page, use a dedicated redaction feature that strips the underlying content, then verify by extracting text and searching for the supposedly removed terms.
When a document must stay restricted rather than become public, state the terms alongside the file: who may open it, whether forwarding is permitted, and when access expires. Technical controls help, but a short plain-language notice travels with every forward in a way settings cannot.
Run the pre-share checklist
Assemble the previous sections into a repeatable routine you run on every outbound PDF. First, inspect: drop the file into the page counter and read every reported field, including the warning banner state, version, page sizes, and exact page count — a count mismatch against your expectation reveals appended or missing pages before recipients find them. Second, trace the images: recall whether any embedded photo originated as a camera file, and if so, rebuild from cleaned sources rather than trusting the assembled PDF.
Third, minimize: remove pages recipients don't need so exposure shrinks with size, then compress what remains and re-inspect the output to confirm the new metadata surface. Fourth, proof the content itself: extract the text and skim it for client names, internal notes, tracked-change remnants, and draft watermarks that survive unnoticed in long documents. Fifth, check the filename, which travels in email threads and download folders long after anyone remembers the context — internal codenames and person names belong nowhere in it.
Finally, send a test copy to yourself through the same channel the recipient will use — the same email, portal, or link — and open it on a different device with fresh eyes. Channel quirks like preview renderers, filename mangling, and permission defaults show up in rehearsal instead of in front of the audience, and the whole checklist costs less time than one recall-and-apologize cycle.
Read version, size groups, and count signals together
The inspection panel rewards readers who look past the headline page count into the supporting vitals. Dropping a file onto the PDF Page Counter triggers immediate local analysis with no button press, and the header answers three questions at once: the page total rendered large with correct singular or plural labeling, the exact byte size formatted for humans, and a status badge confirming readability with the PDF version such as Readable · PDF 1.7. Beneath that ledger sits a details table that lists title, author, creating application, and producing software only when present — absence is itself information, since a blank author row means one fewer leak to chase. Page sizes follow grouped by dimension with point measurements, so a filing that mixes portrait letter sheets with landscape exhibits declares itself as 12 x 612 x 792 pt alongside 3 x 792 x 612 pt instead of hiding the anomaly.
Two failure modes carry their own plain-language verdicts and both warrant attention. A password-protected file cannot be inspected at all and reports that its properties cannot be read without the password, which doubles as a reminder that anything unverifiable cannot be vouched for — unlock a working copy through legitimate means and inspect that copy before circulation. A damaged or mislabeled file reports that it could not be opened and may be corrupted or not a genuine PDF, which usually traces to truncated downloads or renamed extensions rather than exotic malice. When title or author data accompanies a filename, a tinted warning banner advises re-saving before public sharing; treat that banner as a mandatory gate in your routine, and compare the reported page count against your manuscript — an expected 40 pages rendering as 43 means appended appendices or duplicated scans that recipients will notice before you do.
Filenames and channel behavior complete the inspection that metadata tables start. Internal codenames, client surnames, matter numbers, and draft adjectives embedded in filenames travel through inboxes and download folders long after context fades, so rename to neutral descriptive slugs before sending. Note the 100 MB ceiling on the dropzone as a planning constraint for hefty evidence bundles: oversized files split cleanly into inspected halves rather than squeezed through unofficial channels. Record the observed fields — version, dimensions, producer chain — in a single line beside the archived original, and that note becomes the baseline against which every rebuilt derivative is compared in the verification pass below.
Rebuild, recheck, and minimize before sending
Rebuilding gives you a fresh metadata surface to verify, and compression is the most instructive rebuild available because its behavior is measured rather than promised. The Smart engine recompresses embedded raster images inside a worker while text and vector content passes through untouched, so extracted word counts return identical before and after on every fixture containing text. Documented runs anchor expectations: scanned pages saved 58.6% in 1.5 s with words 20 to 20 preserved, photo-heavy pages saved 77.8% in 1.0 s, mixed text-and-image pages saved 71.4% in 0.3 s with words 1,376 to 1,376 preserved, and a single large photo page saved 96.7% in 2.1 s, while text-only pages saved 0% in 0.3 s with words 3,420 to 3,420 preserved and an already-compressed tiny file likewise returned byte-identical at 0%. Those paired figures teach the central lesson: image weight compresses handsomely, text weight was already efficient, and byte-identical output proves nothing changed — including metadata fields that a cleaning hope would have scrubbed.
Photographs inside the document demand a separate hygiene pass at the source-image stage. Embedded pictures can harbor their own capture data — coordinates, timestamps, device models, preview thumbnails — invisible in readers and untouched by document-level inspection, so a contract with a clean properties table can still broadcast where its site photographs were taken. The durable remedy precedes assembly: pass each camera file through the Image Metadata Remover, which re-encodes pixels at quality 94 and writes fresh data only, dropping location, camera, and thumbnail segments by construction while preserving format and appending -clean to downloads, up to 10 files per local batch with originals left unmodified. Remember the boundary that stripping honors: data about the photograph departs, content within the pixels remains, so faces, plates, house numbers, and whiteboard wording need cropping or blurring before the image enters any document. Rebuild the PDF from sanitized sources, then re-inspect the derivative and diff its fields against the baseline note.
Minimization and transmission discipline finish the job that inspection starts. Extract only the pages the recipient requires or split ranges so exposure shrinks alongside bytes — both operations rearrange original content without re-rendering, keeping survivors at full fidelity while absentees vanish structurally. For partial sensitivity inside a retained page, dedicated redaction that strips underlying content is mandatory; painted rectangles hide ink while leaving characters selectable underneath, a fact verifiable in seconds by running the page through text extraction and searching for the supposedly removed terms. Circulate credentials apart from files, state handling terms in plain language beside restricted documents, and rehearse delivery by sending yourself a trial copy through the identical channel and opening it on a separate device where preview quirks, permission defaults, and filename handling reveal themselves before the audience arrives.
Calibrate caution for client, personnel, and medical files
Not every PDF warrants identical suspicion, so tier the routine by stewardship duty rather than running a uniform ritual. Client engagement files — pleadings, conveyances, valuation memoranda, docket exhibits — carry fiduciary obligations where a single leaked author initial or wayward tracked-change remnant can breach confidence; those files get the full inspection ledger, sanitized-source rebuild, narrowed extraction, and rehearsed delivery without shortcuts. Personnel packets — offer letters, appraisal matrices, grievance exhibits, payroll schedules — concentrate identity numbers and compensation figures that invite misuse far beyond embarrassment, so minimization governs: circulate only the pages the recipient must act upon, isolate identification spreads into separately controlled transmissions, and confirm retention windows before archiving duplicates. Medical and insurance bundles — referral narratives, imaging reports, claim itemizations — combine diagnostic candor with billing codes that deserve equivalent restraint, and consent boundaries should travel in the cover note alongside the file.
Custody habits matter as much as any single inspection because leaks compound across versions. Maintain one authoritative folder per matter with the inspected original, the rebuilt derivative, the extraction transcript used for proofing, and a dated line noting observed version, dimensions, and producer chain; retire superseded drafts to a quarantine subfolder instead of leaving look-alike filenames to compete in search results. When colleagues collaborate, designate a solitary editor for the pre-share pass so parallel markups do not resurrect discarded pages or stale metadata after clearance. Expired credentials, departed custodians, and concluded retainers trigger a rotation review: reissue passwords that traveled widely, re-collect files that outlived their purpose, and confirm downstream recipients destroyed drafts they no longer need rather than assuming compliance.
Rehearse the awkward disclosures before they become incidents. If a recipient reports unexpected metadata, an unredacted passage, or an over-broad page range, acknowledge scope promptly, circulate a corrected narrow file with a fresh inspection note, and record the lineage so future audits distinguish the recalled variant from its replacement. Treat near misses — a warning banner nearly skipped, a filename nearly sent with a client surname, a credential nearly pasted into the same thread as the file — as free drills: log what the checklist caught, tighten the step that wobbled, and brief collaborators on the adjustment. That posture converts privacy from a one-time scrub into durable stewardship where each outbound document carries evidence of inspection, minimization, and deliberate release rather than hope that nothing lurked inside.
Frequently asked questions
Does compressing a PDF remove its metadata?
Not reliably. Compression rebuilds the file and refreshes stamps such as producer and version, but fields like author can survive — and text-only files come back byte-identical, meaning nothing changed at all. Always re-inspect after compressing.
Can recipients find my location in a shared PDF?
Only through embedded photos that still carry GPS data in their own EXIF — the document fields themselves hold no coordinates. Clean source images before building the PDF, rather than hoping the PDF step strips them.
Is a password enough to share a sensitive PDF?
A password locks opening, but anyone holding it sees everything: content, images, and metadata alike. Share the password through a separate channel, and never mistake access control for redaction.
How do I check a PDF's page count quickly?
Drop it into the PDF Page Counter — analysis runs the moment the file lands, with no button to press, reporting pages, file size, version, and metadata fields in one view.
Should I delete hidden pages instead of covering them with shapes?
Yes. Deletion copies only kept pages into a fresh file, so dropped sheets are structurally absent. Opaque shapes merely paint over live text that stays selectable underneath and recoverable through text extraction.
Try it now — free, no signup
Know your document before you work with it. Files stay on your device.
Open PDF Info