BASALT · JOURNAL
What 'Quartz PDFContext' means in a PDF's properties
Quartz PDFContext is the name of the PDF writer built into macOS, and it appears in a file's Producer field when that writer produced the file. A typical value reads "macOS Version 15.6 (Build 24G84) Quartz PDFContext". It means the PDF's bytes were written by the operating system, not by a word processor or a design app.
It isn't a virus, a watermark or an error. But the string carries your exact macOS version and build number, and it can replace the Producer your file had before. Both are worth knowing before you send a document to someone outside your organization.
What the string is made of
The Producer field is one of the keys in a PDF's document information dictionary. Software that writes a PDF fills it with its own name. When macOS's own writer does the job, it fills it with the system version, the build in parentheses, and the writer's name.
On macOS 15.6, a PDF written through the system's PDF context had this Producer: macOS Version 15.6 (Build 24G84) Quartz PDFContext. The header of that file was %PDF-1.3, and it had no XMP packet. The version and build change with each macOS release, so a file made on another Mac shows different numbers in the same pattern.
Quartz is Apple's name for the 2D drawing layer of macOS, and the last word of the string names a PDF drawing context, the target an app draws into when its output is a PDF. Apple doesn't publish a page explaining the Producer string itself, so treat any more detailed account you read elsewhere as an inference.
Creator and Producer are different fields
People often read the two fields as one. They aren't.
- Creator (
/Creator) names the application that made the original content. Preview's Inspector labels it Content creator. For a letter written in a word processor, it's usually that word processor. - Producer (
/Producer) names the software that wrote the PDF file. Preview's Inspector labels it PDF Producer.
A file can have a Creator of one app and a Producer of Quartz PDFContext. On macOS 15, a file drawn by a small app that named itself as Creator came out exactly that way, and a re-save through the system's PDF framework keeps the old Creator while replacing the Producer. The Creator points to where the content came from. The Producer names what last wrote the file, as long as that software updated the field.
If you want to see how the other fields behave, why a PDF shows an author name covers the Author field, and how to see a PDF's metadata on a Mac walks through every built-in view.
Why a file you didn't print shows it
There are two ways the string gets there. The first is the obvious one: an app on your Mac wrote the file through the system's PDF writer. Many apps reach it through a Print dialog's PDF menu or an export command, though which route a given app takes varies.
The second is a re-save. On macOS 15.6, a PDF opened and saved again through PDFKit, the PDF framework built into macOS, came back with its Producer replaced by the Quartz string. The creation date was replaced with the time of the save, and the modification date was set to the same moment. Author, Title, Creator, Subject and Keywords were kept, the file was rewritten as one saved generation, and the trailer got a new /ID. An XMP packet in the original came through unchanged, so its own creation date and creator tool no longer matched the new Producer and creation date.
That's PDFKit's own write call. Preview's Save command wasn't part of it, so don't assume Preview does the same. Whatever app you use, the Producer after a save tells you whether the system's writer rewrote the file.
This is why a Quartz Producer is a weak clue by itself. It says a Mac's PDF writer touched the file, not that the content was written on a Mac, and not when. How to see when a PDF was created explains why a replaced creation date misleads.
How to check the Producer on a Mac
In Preview, choose Tools > Show Inspector and open General Info. PDF Producer is the Producer field and Content creator is the Creator field.
In Terminal, Spotlight's reading of the file uses different names. Here kMDItemCreator is the Creator and kMDItemEncodingApplications is the Producer:
mdls -name kMDItemCreator -name kMDItemEncodingApplications document.pdfFor a file in a place Spotlight doesn't index, such as a temporary folder, a test import reads it the same way and writes nothing to the index:
mdimport -t -d2 document.pdfTo see the raw string as stored, search the file. This works on files macOS wrote, which carry a %PDF-1.3 header from before compressed object streams existed. Other files can keep their dictionaries in those streams, where a raw search finds nothing:
grep -a -o 'Quartz PDFContext' document.pdfA hit proves the text is in the file. No output doesn't prove it's absent. Make an uncompressed copy with qpdf --qdf --object-streams=disable document.pdf expanded.pdf and search that. In the raw file, the parentheses inside the Producer are escaped with backslashes, which is why the command searches only for the last two words.
The AppendMode 1.1 suffix, which Apple doesn't document
Some files show AppendMode 1.1 after "Quartz PDFContext" in the Producer field. Apple doesn't document AppendMode anywhere, so there's no official meaning to report, and a confident explanation found elsewhere is a guess.
What you can verify is the structure of the file. Count the end-of-file markers:
grep -a -c '%%EOF' document.pdfOne marker means one saved generation, and more than one means the file holds more than one. A linearized file, one optimized for fast web view, also has two markers with no edits at all, so a count above one is a reason to look, not a verdict. How to tell if a PDF has been edited goes through what the marker count can and can't show.
What to do if you'd rather not share it
If the Producer string reveals more than you'd like, you can leave it, since it only names an operating system release, or remove it along with the other document properties.
Order matters. Exporting or re-saving through the system's PDF writer puts a fresh Quartz string back, so remove the properties after the last export, not before it. Then check the file again with the commands above. Removing metadata from a PDF on a Mac lists what to clear and in which order.
Frequently asked questions
What is Quartz PDFContext?
Quartz PDFContext is the name macOS's built-in PDF writer puts in a file's Producer field. A full value looks like "macOS Version 15.6 (Build 24G84) Quartz PDFContext". It means the PDF's bytes were written by the system, usually after an app printed or exported to PDF, or after an app re-saved the file through the system's PDF framework.
Is Quartz PDFContext a virus or a sign of tampering?
No. It's an ordinary Producer string that macOS writes. It doesn't mean malware and it doesn't prove anyone edited the file. It only says the system's PDF writer produced or rewrote the file. For the real question of whether a file was changed, look at its saved generations and any digital signature instead.
Does Quartz PDFContext mean my PDF was made on a Mac?
Not necessarily. It means a Mac's PDF writer wrote the file you have, which can be a re-save of a document made elsewhere. On macOS 15.6, a re-save through PDFKit replaced an earlier Producer with this string while keeping the Author and Creator. So the content may have started on another system.
What's the difference between PDF Creator and PDF Producer?
Creator names the application that made the original content, and Producer names the software that wrote the PDF file. In Preview's Inspector they're labeled Content creator and PDF Producer. A document typed in a word processor and printed to PDF on a Mac can show the word processor as Creator and Quartz PDFContext as Producer.
What does the undocumented AppendMode 1.1 suffix mean?
Apple doesn't document that suffix, so its purpose isn't confirmed and a guess would only mislead. The reliable check is to count the file's end-of-file markers with grep -a -c '%%EOF' document.pdf. A count of one means the file was written in a single pass, and more than one means appended updates or a linearized file.
Does Quartz PDFContext reveal my macOS version?
Yes. The string includes the system version and build, such as 15.6 and 24G84. Anyone who opens the file's properties can read them. That's rarely sensitive, but if you share files from a machine you'd rather not describe, remove the document properties before you send the file.
Can I change the Producer of a PDF?
Yes, with software that edits document properties, but the change lasts only until the next save through the system's writer, which puts the Quartz string back. Removing the properties as the final step is more dependable than editing them. Afterward, check the file in Preview's Inspector or with mdls.
Doing it in Basalt
Basalt can tell you whether a Producer or Creator is there without repeating it. Its Inspect tool reports which document properties are filled, including Creator and Producer, with a plain explanation, and it counts saved generations for any PDF. It doesn't show the values, so use Preview's Inspector or mdls to read them. To remove them, the Strip metadata step in Run a Procedure rebuilds the file from its pages, which clears the document properties, the stored dates and the XMP packet, and also drops bookmarks and tags. Basalt can't write a new Producer. It only removes. The original is never modified, since every tool writes a new file. It's $29 once for up to three Macs, with a 24-hour free trial of every tool.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.
