BASALT · JOURNAL
Removing personal information from a PDF before you share it
Most attempts to remove personal information from PDF files deal only with what is visible on the page, which is roughly half the problem. The other half sits in structures a viewer never renders: document metadata, the XMP packet, form field values, annotations, embedded attachments, and the EXIF block inside any photograph placed in the file. Clearing the page and leaving those in place produces a document that looks clean and is not.
What counts as personal information here
Work from a written list rather than memory, because the categories that get missed are ordinary ones appearing in unexpected places.
Names. The subject's name, but also relatives, colleagues, referees, and anyone quoted. Names appear in running headers, footers, table cells, signature blocks, and the file name stored in the metadata.
Postal addresses. Full and partial. A street plus a town is frequently identifying on its own, and fragments hide in letterheads and delivery panels.
Phone numbers and email addresses. These live in signature blocks, footers, fax headers, and inside hyperlink annotations, where the visible text says one thing and the underlying URI is mailto: plus the real address.
National identification numbers. Social Security, national insurance, tax, passport, driver license, and health identifiers. High value, format-predictable, and usually printed more than once.
Dates of birth. A date of birth with a postal code and a gender is close to unique for most people, so it stays an identifier even after the name is gone.
Signatures. A handwritten signature is an image, unaffected by anything you do to text, and it can be lifted cleanly and reused.
Photographs. A face identifies, and so does the background: a badge, a license plate, a house number, or a screen in the frame.
Where personal information hides when the page looks clean
The content stream. Text is painted by operators whose operands are character codes. A black rectangle drawn on top is one more instruction, and the codes stay readable to any extraction tool. This is the most common way a redaction fails.
Document metadata and XMP. These carry the author name from the account that created the file, the producing application, timestamps, and very often the original file path. A path like /Users/jsmith/Clients/Alvarez/intake_final.pdf names a person, a client, and a machine. The two stores can disagree, so both need clearing. See removing PDF metadata on a Mac.
EXIF inside embedded photographs. A JPEG placed into a PDF usually retains its own metadata block, which can include GPS coordinates, a capture timestamp, a camera serial number, and sometimes an owner or artist name. Clearing PDF-level metadata does not touch it, because it lives inside the image object.
Annotations and hyperlinks. Comments store their text separately from the page, and link annotations store a target URI that need not match the visible text.
Form field values. A completed form stores values in the AcroForm dictionary independently of the visible appearance, so painting over the appearance leaves the value readable.
Attachments, hidden layers, and earlier revisions. An embedded spreadsheet is untouched by page edits, a switched-off optional content group is fully present, and a PDF saved incrementally keeps the old bytes, so a parser can reach the unredacted page inside a file that displays correctly. Hidden data in PDFs walks through each carrier.
How to remove personal information from PDF files, in order
Inspect first, because the invisible carriers are the ones you forget once you are absorbed in page work.
Clear the file-level structures next: strip metadata and XMP, remove attachments, resolve or remove annotations and hyperlinks, resolve form field values, and remove hidden layers. Doing this first means no late edit reintroduces something you already cleared.
Then build the value list and search the whole document for each entry, including formatting variants: a phone number with and without spacing, a name in First Last and Last, First order, an identification number with and without separators. Searching a value across the file is what produces consistency, which page-by-page review never achieves.
Handle images after the text. Photographs, signature blocks, scanned ID cards, logos, and barcodes each need the pixels in the marked region destroyed and the image re-encoded, not covered. If the file is a scan, the OCR layer beneath the image holds text that survives anything done to pixels alone. Redacting images inside a PDF covers that case. Save as a single generation rather than an incremental update, then verify.
Verifying that it worked
Verification means opening the produced file with something other than the tool that wrote it. Extract the text and search for every value on your list, extract the embedded images and open them directly to confirm the sensitive region is destroyed rather than covered, read the metadata separately, and check whether the file contains more than one revision.
A confirmation dialog reports intent, not outcome. Where a writer makes a wrong assumption, the same application's reader usually makes the same one. Verifying a PDF redaction gives the specific commands.
Frequently asked questions
How do I remove personal information from a PDF permanently?
Use a tool that removes characters from the content stream and destroys image pixels rather than drawing over them, and have it strip metadata, XMP, attachments, annotations, form field values, and hidden layers as it writes the file. Save as a single generation so no earlier revision remains inside, then extract text and images with a separate parser and confirm the values are absent.
Does deleting text in a PDF editor actually remove it?
Sometimes, and not reliably. Some editors genuinely rewrite the content stream, while others draw a white rectangle over the text or set it invisible, both of which leave the characters extractable. Editors also commonly save incrementally, which keeps the original objects even when the edit was real. The only way to know is to extract text from the saved file.
What personal information is stored in PDF metadata?
PDF metadata commonly holds the author name from the account that created the file, the producing application, creation and modification timestamps, the document title, and the original file path. The XMP packet can add editing history and identifiers linking the file to earlier versions. The file path is often the most revealing item, since it names people, clients, and projects.
Do photos inside a PDF still contain GPS data?
Yes, in many cases. A JPEG embedded in a PDF usually keeps its own EXIF block, which can include GPS coordinates, the capture date and time, the camera model and serial number, and sometimes an owner name. Clearing the PDF's own metadata does not touch it, because it sits inside the image object.
How do I remove a signature from a PDF?
Treat it as an image redaction, not a text one. A signature is pixel data placed on the page, so the region has to be destroyed and the image re-encoded for the signature to be gone from the file. Drawing a white or black box over it leaves the original image object embedded and extractable with any PDF tool. Verify by extracting the images from the finished file.
Is it safe to use a free online PDF redaction tool?
Uploading the file sends the unredacted document to whoever operates the service, and that happens before any removal is applied. For documents holding identification numbers, addresses, or financial detail, that exposure is the whole risk you were trying to manage. Local processing on your own machine avoids it entirely and does not depend on trusting anyone else's retention policy.
Will removing personal information break the PDF?
No, if the removal is done by a tool that rewrites the file properly. Excising glyphs from a content stream and re-encoding an image produces a valid PDF that opens, prints, and paginates normally. What changes is that the removed content no longer exists, so text extraction returns nothing in those regions and extracted images show destroyed areas rather than covered ones.
How do I check what personal information a PDF still contains?
Inspect the file rather than looking at it. Extract the full text, list the embedded files, read the information dictionary and the XMP packet, extract the images and check their own metadata, enumerate annotations and form fields, list optional content groups, and check for multiple revision markers. A viewer shows only the rendered page, which cannot distinguish a real removal from a drawn rectangle.
Doing it in Basalt
Basalt begins with an Inspector that reports what a document still carries: metadata, XMP, embedded files, hidden layers, annotations, and OCR text layers, so you see the problem before marking anything. Redaction then destroys content rather than covering it, with text excised from the content stream glyph by glyph, image pixels under a mark destroyed and the image re-encoded, the OCR layer under a mark destroyed as well, and metadata, XMP, attachments, and hidden layers stripped as the file is written in one generation. Search and redact applies a value across the whole document, so nothing survives in a header you did not read, and a verifier then re-opens the written bytes with an independent parser and proves the content is gone before anything is saved. If it cannot prove that, no file is written. Nothing is uploaded, because the engine has no network entitlement, enforced by macOS at the code signature level, and it is $29 once, lifetime, up to three Macs, free for 24 hours, with redacting a bank statement covering the finance-specific case.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.