What a file gives away when you send it
The short answer. A file gives away three things: what is in it, what is attached to it that you never see, and where it travels afterwards. A phone photo carries GPS coordinates, a PDF keeps every word under a black box, and a .docx names its author. Do the six steps below before you attach anything.
The short version
Before you attach a file, check four things in this order: what is actually in it, what metadata is attached to it, whether anything hidden survives the format, and whether the file needs a password at all. Do them in that order, because each step can undo the last: stripping metadata after redacting is fine, redacting after flattening is not.
What each kind of file carries
| File | Carries, invisibly |
|---|---|
| Photo (JPG, HEIC) | camera and phone model, date and time, often GPS coordinates, sometimes a serial number and a thumbnail of the uncropped original |
| author and producer software, creation and modification times, and the full text under anything drawn on top of it | |
| Word, Excel, PowerPoint | author and last-modified-by names, total editing time, tracked changes, comments, hidden rows and columns, the whole sheet behind a chart, and the parts of an image you cropped away |
| Zip | every file name and size, readable even when the contents are encrypted |
| Screenshot | whatever else was on the screen: notifications, browser tabs, the name in the corner of the window |
The one that catches professionals: a black box is a drawing
This is the failure that ends up in the news, and it is worth being precise about. When you draw a black rectangle over a name in a PDF, or use a highlighter set to black, you have added a shape to the page. The text is still in the file, underneath it. Anyone can select it, copy it, or run text extraction and read every word you thought you had removed. The same is true of a coloured box in Word before the document is exported.
Redaction has to remove the content, not cover it. Two ways that actually work:
- Flatten the page to an image. Export the PDF pages as images with PDF to Image, black out the area in an image editor, and rebuild a PDF from the images with Image to PDF. The text no longer exists anywhere in the file. You lose selectable text and searchability, which is the price.
- Extract only what you are willing to send. Rather than redacting a twelve-page statement, split out the two pages that are needed. Removing a page removes everything on it, with no judgement required.
If you take one thing from this: check your own redaction by trying to select the text under it. Ten seconds, and it is the only test that matters.
Photos: the location, and the copy you thought you cropped
Phones record GPS coordinates in the photo file unless location is turned off for the camera, and they are accurate to a few metres. A photograph of an item for sale, taken at home, tells a stranger where you live. The date and time tell them when you are usually there.
Two second-order things people miss. Some editors keep an embedded thumbnail of the original after a crop, so the part you cropped out can be recovered from the file. And metadata often survives a resize or a conversion, because most tools copy the tags across rather than dropping them.
Stripping EXIF from a JPG or PNG need not cost any quality: the metadata blocks can be cut out and the image data copied byte for byte, which is what Metadata Remover does after showing you what the photo carries. Social networks generally strip metadata on upload, which is why people assume it never matters, but an email attachment, a WhatsApp document send, a shared drive and a print shop's USB stick all pass the file through untouched.
Office files: the edit history you did not know was attached
A .docx is a zip of XML files, and several of them are about you rather than about the document. The author name from whoever created the template. The last-modified-by name. The total editing time, which has been used in contract disputes to show how long a clause took to write. Comments and tracked changes, which are not deleted by hiding them — accepting or rejecting is what removes them.
Spreadsheets add their own. Hidden rows and columns are hidden, not absent. A filtered view still contains every filtered-out row. A chart pasted into a presentation often carries the entire source worksheet with it, so a single slide can hand over a whole pricing model.
The reliable habit: when a document is going outside the organisation, send a PDF, made after accepting all changes and deleting all comments. It removes most of this in one step, and it stops the recipient's layout from moving as well.
Zips and passwords
A password-protected zip encrypts the contents and leaves the file names and sizes visible to anyone who opens the archive. An archive called appraisal-anita-2026.pdf inside documents.zip has already said the interesting part. When the names themselves are sensitive, encrypt the file with Encrypt File rather than zipping it with Protect ZIP, because a single encrypted file hides its own name too.
Then the part that undoes all of it: never send the password in the same message as the file. An email with the attachment and the password in the body protects nothing at all, because anyone who has one has both. Send the file by email and the password by phone or message. Use a long passphrase of several unrelated words rather than a short complicated one, since the attempt to break it can be made offline as fast as a computer allows.
Password protection on a PDF (Protect PDF) is the most convenient of the options and the least contained: the recipient can usually remove it, print it, or forward the opened copy. It keeps an honest person out of a file that is not theirs. It does not control what happens afterwards, and nothing does. For documents that will circulate, a visible watermark naming the recipient is more useful than a password, because it does not stop copying but it makes a copy traceable.
Where the file goes after you send it
An email attachment is copied to your sent folder, your provider's servers, the recipient's provider, their device, and every device of everyone the mail is later forwarded to. Recalling a message does not reach any of those copies. A shared link, by contrast, can be revoked and its access checked, which is why a link is usually the better choice for anything large or sensitive, provided the link itself is not "anyone with the link".
The order to work in
- Reduce. Send the two pages, not the twelve-page file. Nothing beats not sending it.
- Redact properly. Remove the content; do not cover it. Then test by selecting.
- Flatten or export. Accept changes, delete comments, export to PDF or to images.
- Strip metadata from the final file, once, at the end.
- Encrypt if it warrants it, and choose the form: an encrypted file hides names, a protected zip does not, a protected PDF stays openable anywhere.
- Send the password separately, by a different route.
Steps two to five all happen on your own device with the tools on this site: nothing is uploaded, which is the only sensible arrangement for a set of tools whose entire purpose is a file you do not want other people to have.
Questions people ask
Does a black box in a PDF really remove the text?
No. A rectangle drawn over a name is a shape on top of the page, and the words stay in the file for anyone to select, copy or extract. Remove them instead: export the pages as images, black out the area, rebuild the PDF, and then test by trying to select the text under the box.
Do photos carry location data when you send them?
Usually, unless location is switched off for the camera: the file holds GPS coordinates accurate to a few metres, the date and time, and the phone model. Sending as an email attachment, a WhatsApp document or on a USB stick keeps all of it; stripping it first costs no image quality.
Is a password-protected zip safe to email?
The contents are encrypted, but every file name and size inside stays readable to anyone who opens the archive, so a name like appraisal-anita-2026.pdf has already told the story. Encrypt the file itself when names are sensitive, and never send the password in the same message as the attachment.
How do I send documents securely by email?
Send only the pages needed, redact by removing text rather than covering it, export to PDF after accepting changes and deleting comments, strip metadata from the final file, encrypt it if it warrants that, and send the password by another route. For anything large or sensitive, a link you can revoke beats an attachment.
Sources
Checked 22 Oct 2026:
- ISO 32000-1 (PDF 1.7), PDF 32000-1:2008, clause 8 (Graphics) and clause 9 (Text): a rectangle drawn over text is a graphics object on the page, and the text object under it remains in the content stream
- CIPA DC-008, the Exif standard, from the Camera & Imaging Products Association, cipa.jp: the GPS, date-time and camera tags a photo file carries
- ECMA-376, Office Open XML: the core and extended properties parts (creator, lastModifiedBy, TotalTime) inside every .docx, .xlsx and .pptx
The tools for this
Related guides
- How to turn phone photos into one PDF, and make it small enough to uploadPut phone photos into one PDF in the order you choose, one or several per page, then shrink it for a portal. 12 photos at two per page make 6 pages.
- How to open and convert iPhone HEIC photos to JPG on WindowsWhy iPhone photos are HEIC, the two Microsoft Store extensions that let Windows open them, how to convert to JPG, and the iPhone setting that stops HEIC.