BASALT · JOURNAL
How to see a PDF's metadata on a Mac, including what Finder misses
To see a PDF's metadata on a Mac, open the file in Preview and choose Tools > Show Inspector, or click the Info button in the toolbar. The General Info pane lists the title, author, subject, content creator, PDF producer, PDF version and the creation and modification dates stored in the file. That's the quickest view, but it isn't the complete one.
Finder, Spotlight and the mdls command read the same file differently, and on macOS 15 none of the built-in views show the XMP packet, the second metadata store many PDFs carry. A view that leaves a field out looks exactly like a file that doesn't have it, which is the wrong thing to learn just before you send a document outside your organization.
What metadata a PDF actually carries
A PDF keeps its metadata in two separate places, and neither of them is on a page.
The first is the document information dictionary, an object the file's trailer points to. Its keys are /Title, /Author, /Subject, /Keywords, /Creator, /Producer, /CreationDate and /ModDate. /Creator names the application that made the original content, such as a word processor, and /Producer names the software that wrote the PDF bytes. Dates are stored as text like D:20190314093000+01'00'.
The second is XMP, an XML packet stored as a stream that the document catalog points to with /Metadata. It holds the same kind of information under other names, dc:title, dc:creator, xmp:CreatorTool, xmp:CreateDate, plus document identifiers and sometimes an edit history. The two stores are written by different code and often disagree. What XMP metadata is covers the packet in detail, and why a PDF shows an author name covers where the author usually comes from.
There's also the trailer's /ID pair, two identifiers that can link a file to earlier versions of itself. None of the built-in views shows it.
Preview's Inspector shows the stored fields
Open the PDF in Preview, then choose Tools > Show Inspector. The Inspector has separate panes, chosen with the buttons at the top of its window: General Info, Keywords, Crop, Annotations and Encryption.
General Info is the one you want. For a PDF it shows the file name, document type, file size, page size and page count, then Title, Subject, Author, Content creator, PDF Producer, PDF version, Creation date and Modification date. Content creator is the /Creator key and PDF Producer is /Producer. Keywords live in their own pane.
Two other panes are worth a look while you're there. Annotations lists comments and markup with their type, author, date and page, which is where reviewers' names tend to hide. Encryption shows whether the file is password protected and what it permits.
What Preview's fields don't include is XMP. On macOS 15 the system's PDF framework, PDFKit, reads none of the XMP packet, so a file whose author appears only in XMP shows a blank Author field here.
Finder and mdls show Spotlight's reading of the file
Finder's Get Info window shows some of the same fields under More Info, and they come from Spotlight's index. You can print Spotlight's full reading of a file in Terminal:
mdls -name kMDItemTitle -name kMDItemAuthors -name kMDItemCreator -name kMDItemEncodingApplications document.pdfkMDItemTitle is the stored title, kMDItemCreator is /Creator and kMDItemEncodingApplications is /Producer. Three behaviors, tested on macOS 15.6, make this view misleading if you don't know them.
- Authors can show an app, not a person. When a file has both
/Authorand/Creator, Spotlight puts the Creator value inkMDItemAuthors. A PDF written by a person named in/Authorcan show a word processor as its author in Finder. - XMP is ignored. A file whose only metadata is an XMP packet shows no title and no author at all.
- The dates are the file's dates.
kMDItemContentCreationDateis when the file landed on this disk, not the/CreationDatestored inside. When a PDF was created explains which date means what.
mdls only knows about files Spotlight has indexed, so it shows little for a file in a temporary folder or on an excluded drive. For any file, anywhere, a test import reads it the same way and stores nothing in the index:
mdimport -t -d2 document.pdfA file that needs a password to open gives Spotlight nothing to read, so an almost empty result is itself a clue. Check the Encryption pane in Preview.
Reading everything with qpdf
To see both stores exactly as they're written, install qpdf with brew install qpdf. It only reads here. Start with the trailer, which names the objects you need:
qpdf --show-object=trailer document.pdfThe output includes something like /Info 6 0 R /Root 5 0 R, and usually the /ID pair. Print the information dictionary by its number, then the catalog, which shows /Metadata 7 0 R if the file has XMP:
qpdf --show-object=6 document.pdf
qpdf --show-object=5 document.pdf
qpdf --show-object=7 --filtered-stream-data document.pdfThe last command prints the XMP packet decoded, so you can read dc:creator and the other properties yourself. Use your file's numbers, not these.
Why not just search the raw file for a name? Since PDF 1.5, dictionaries can sit inside compressed object streams. On a test file stored that way, a plain grep -a for the author's name found nothing, while qpdf, Preview and mdls all read it without trouble. If you want to search the whole file, make an uncompressed copy first with qpdf --qdf --object-streams=disable document.pdf expanded.pdf and search that.
What to do with what you find
If a field shouldn't leave with the document, fix it where it was made. Change the author or title in the source application's document properties and export again, then check the new file with the same commands. Remember that clearing a field in one store doesn't clear the other, and that a re-save can add fields of its own. The checklist in removing metadata from a PDF on a Mac goes through both stores.
Metadata is one part of what a file carries off the page. Embedded files, hidden layers, annotations and earlier saved versions are separate. What a PDF still carries lists them, and how to see everything a PDF is carrying shows how to read the structure.
Frequently asked questions
How do I see PDF properties on a Mac?
Open the PDF in Preview and choose Tools > Show Inspector, or click the Info button in the toolbar. The General Info pane shows the stored title, author, subject, content creator, PDF producer, version and dates, and separate panes show keywords, annotations and encryption. Finder's Get Info shows a smaller set taken from Spotlight.
Do PDFs have metadata?
Almost always. The software that creates a PDF usually fills in the producer and the dates, and often the creator, title and author from your account or the source document. Many files also carry an XMP packet with the same information in a second place. Neither store appears on any page, so you only see it by looking for it.
Why does Finder show an app name as the author of my PDF?
Because Spotlight, which Finder reads, puts the /Creator value into its Authors field whenever the file has one, even when a separate /Author entry names a person. Tested on macOS 15.6, a file with both showed the application as its author. Preview's Inspector shows the two fields separately as Author and Content creator.
Why doesn't Preview show an author that another app finds?
The other app is probably reading the XMP packet, which holds its own author field, dc:creator. On macOS 15 the system's PDF framework ignores XMP entirely, so Preview, Finder and mdls can all show a blank author while the XMP still names one. Print the packet with qpdf to see it.
Can I see a PDF's metadata without opening it?
Yes. In Terminal, mdls prints Spotlight's record of a file, including its title, author, creator app, producer, version and page count, without opening it in any viewer. For a file Spotlight hasn't indexed, mdimport -t -d2 followed by the file's path reads it the same way and stores nothing. Both show only what Spotlight understands, which excludes XMP.
What's the difference between Content creator and PDF Producer?
Content creator is the /Creator key, the application that produced the original content, such as a word processor or a design app. PDF Producer is /Producer, the software that wrote the PDF file itself, which can be a separate export engine or the operating system's PDF writer. Together they describe the toolchain, often down to version numbers.
Does PDF metadata show who opened or edited a file?
No. A PDF has no log of who opened it. Its metadata records what the creating and saving software wrote: an author, the applications involved, and creation and modification dates that any re-save can change. An XMP history, if present, lists software and times, not people. Treat all of it as a hint, not evidence.
Doing it in Basalt
Basalt has an Inspect tool that reads any PDF and tells you which document properties are filled, whether an XMP packet is embedded, and what else travels off the page: saved generations, embedded files, JavaScript, hidden layers and annotations. It never quotes the values, so the report itself doesn't repeat what it found, and it carries the file's SHA-256 so it's tied to one exact document. To clear the metadata, the Strip metadata step in Run a Procedure removes the author, title, keywords and XMP by rebuilding the file from its pages, which also drops bookmarks and tags. Basalt can't write a new title or author, only remove them. The result is a new file and your original is untouched. The engine that opens documents has no network entitlement. It's $29 once for up to three Macs, free for 24 hours.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.
