Remove hidden data from a PDF before you share it
Use Sanitize PDF. It shows what your PDF carries besides its pages, such as metadata, attachments, scripts and hidden layers, removes what you tick, and gives you a report. It runs in your browser.
Updated 2 min read
Metadata can reveal the author's name, the software used and when the file was edited. A hidden layer can still hold a draft paragraph. An attachment can carry a whole spreadsheet. Sanitize before a PDF leaves your organization: a contract going to the other side, a court or tender submission, or a file you publish online.
Step 1: Add your PDF
Open Sanitize PDF and drop in the file. It's inspected in your browser; nothing is uploaded.
Step 2: Review what was found
Under What this PDF contains, each type of hidden data shows a count. Items with nothing found are greyed out.
Step 3: Choose what to remove
Everything found is ticked except Comments and markup. Untick anything you want to keep.
Step 4: Sanitize and download
Click Sanitize and download, then check the Report of what was removed and what was kept. Anything marked Not fully removed needs a look before you share the file.
What it can remove
- JavaScript and automatic actions, including XFA forms, which fall back to their plain form fields
- Attachments
- Metadata: author, title, software and dates, plus XMP metadata
- External links: web links and links to other files
- Form submit actions: buttons that send form data to a server
- Hidden layers: content on layers that are switched off by default
- Private app data and thumbnails left by the authoring app
- Comments and markup (off by default)
What stays
- Visible text and images. Sanitizing isn't redaction: redact content you can see.
- Form fields and their values. Only actions that submit data to a server are removed.
- Links to pages inside the same PDF.
- Comments, unless you tick Comments and markup.
For a document going outside, the usual order is: redact what's visible, sanitize what's hidden, then password-protect if needed.
Is the metadata gone completely?
The document properties and every XMP metadata packet, including those on images, are removed. The file name is up to you, so rename the download if the name itself is sensitive.
Does it find white text on a white background?
No. Text hidden by color, under an image or outside the page area isn't detected.
Do I need an account?
No. Sanitize PDF is free without an account.
Tools in this article
Did this answer your question?
Related articles
- Why black boxes and whiteout aren't redactionErase (whiteout) and Blackout only cover content visually, and the text underneath stays in the file where anyone can copy it out. Redact removes it: after you apply redactions, each affected page is rebuilt without the marked content.
- Password-protect or unlock a PDFUse Protect PDF: choose Require a password to open, set the Open password, pick what's allowed and click Protect PDF. Unlock PDF removes a password you know. Both run in your browser, and nobody at PDFBetter can recover a forgotten password.
- Redact a PDF permanentlyChoose Redact (in the Cover group), drag over everything to remove, then click Apply redactions and confirm. Text, images and drawings under each mark are removed from the file, not just covered, and the affected pages become images.
- Where your files are stored and who can open themBrowser tools such as merge, split and rotate never upload your file. Documents you edit, fill or sign are stored in Cloudflare R2, encrypted at rest, and only you, people you share with and your team (for team documents) can open them.