The Data Riding Along With Your Resume — PDF Metadata Leaks Explained
It's easy to assume a PDF is safe once you've deleted whatever text and images are visible on screen, but PDFs also carry information that never shows up on the page. Things like the username of the computer that wrote your resume, a leftover document title naming a company you applied to previously, or version details from the word processor your employer uses all live inside the file itself. The catch is that this metadata isn't stored in one place — it's duplicated across two separate stores, and it's common for people who don't know this structure to clear one of them, assume the file is now anonymous, and be wrong.
1. Info Dictionary and XMP — why two stores exist
The metadata mechanism that has existed since the PDF standard was first created (Adobe's original PDF 1.0 spec) is the Info Dictionary. It's a simple list of key-value pairs — Title, Author, Subject, Keywords, Creator, Producer, CreationDate, ModDate — living in the trailer section at the end of the file. It's lightweight and easy to parse, but it can only express a narrow range of information. Later, Adobe introduced an entirely separate XML-based metadata system called XMP (Extensible Metadata Platform), built to share metadata across other Adobe products like Photoshop and InDesign and to represent more complex data such as copyright details and edit history. The problem is that when XMP was introduced, the old Info Dictionary wasn't retired — it was kept around and run in parallel, for the sake of backward compatibility. The result is that a modern PDF effectively carries the same information twice.
2. Why the two stores don't stay in sync
The Info Dictionary and XMP are written and edited independently, at different times, often by different pieces of software. The word processor that originally created the document fills in both stores with initial values, but once that file is edited by a different tool, or the title and author are changed manually through a "Properties" dialog, most programs only update the Info Dictionary and leave XMP untouched. The reverse happens just as often — some online PDF editors or anonymization scripts scrub the XMP block clean and never touch the legacy Info Dictionary at all. Because there's no standard rule tying the two stores together and keeping them in sync automatically, "I cleared the metadata" often really means only half the metadata got cleared. So someone deletes a company name or author name from the Author field, feels safe, and doesn't realize the same information is still sitting in XMP — visible the moment anyone looks a little deeper at the file's properties.
3. What to check before you submit a file
Before sending an official document or resume to someone outside your organization, it's worth making a habit of checking the file's internal metadata, not just the visible body text. Start with a PDF metadata viewer to look at the title, author, creator application, and producer application values for anything unintended. If something turns up, clean it with a PDF metadata remover. The important part is confirming that the removal tool clears both the Info Dictionary and XMP — a tool that only touches one of them can leave information you thought you'd deleted sitting untouched in the other. It's safest to re-check both stores with the metadata viewer again after cleanup.
4. Summary
- PDFs store metadata twice: the legacy Info Dictionary and the XMP that Adobe added later exist side by side.
- Clearing only one is incomplete: the two stores aren't kept in sync automatically, so touching just one is never a full erase.
- Double-check before submitting: view with a metadata viewer → clean with a removal tool → verify again with the viewer.
Frequently Asked Questions
Q. Where inside a PDF file is metadata actually stored?
A. In two places. One is the Info Dictionary in the PDF trailer — simple key-value pairs like title and author. The other is XMP, an XML-based metadata format Adobe introduced later. Most modern PDFs write metadata into both.
Q. Why does the format have two separate storage mechanisms?
A. The Info Dictionary has existed since PDF 1.0 — it's simple but can only express limited information. Adobe later added XMP, an XML-based system, so metadata could be shared across other Adobe products like Photoshop and InDesign and could hold richer information such as copyright and edit history. For backward compatibility, the old Info Dictionary was never removed, so the two now exist side by side.
Q. I deleted the author name, so why is information still showing up?
A. Many document editors and online tools update only the Info Dictionary and leave XMP untouched, or the reverse — they clear XMP but never touch the Info Dictionary. Since the two stores aren't automatically kept in sync, clearing just one can leave the original information intact in the other.
Q. What should I check before submitting a resume or contract?
A. Use a PDF metadata viewer to check whether the title, author, creator application, and producer application fields still contain a previous employer's name, your real author name, or an internal system name. If they do, run a metadata removal tool that clears both the Info Dictionary and XMP before you submit the file.