PDF Metadata Steganography Extractor
Auto-detect and extract hidden data from PDF metadata across all 6 methods, with confidence scoring, CTF flag detection, forensics report, and batch extraction.
Try the demo instantly
Loads a PDF with a hidden message already embedded
Drop a PDF file here or click to browse
PDF 1.4–2.0 · Max 50 MB
Processing happens entirely in your browser — nothing is uploaded.
How to Extract Hidden Data from a PDF (5 steps)
- Upload the PDF — all 6 methods are scanned automatically, right in your browser
- Review the confidence-ranked results (a preview scan runs before you even click Decode)
- Enter the password if a result shows 🔒 Encrypted
- Click Scan & Extract to decrypt/decompress and view the payload
- Download the extracted payload, or the full JSON decode report
PDF Metadata Extraction — 6 Methods Compared
| Method | Technique | Capacity | Best For |
|---|---|---|---|
| XMP Metadata | Reads Author/Title/Subject/Keywords/Creator/Producer fields | ~60 KB per field | First and fastest check — 40% of real CTF challenges |
| Custom Metadata Key | Scans every non-standard Info dictionary key | ~60 KB | Professional watermark recovery |
| Object Stream | Scans every indirect object for the PDFMETA header, referenced or not | Up to 50 MB | Advanced CTF, large payload recovery |
| Whitespace Encoding | Reads space/tab patterns inside text-showing strings | Depends on carrier text | Expert CTF, SNOW-style challenges |
| Incremental Update | Finds the most recent appended PDFMetaHidden object | Up to 50 MB | Forensics — file-size-growth investigations |
| Embedded File Attachment | Inflates every /EmbeddedFile stream and checks the header | Up to 50 MB | File smuggling recovery |
Frequently Asked Questions
Is this for viewing PDF properties?
No — this EXTRACTS hidden steganographic data. For viewing plain metadata, use a metadata viewer. This tool is for CTF challenges, forensics, and watermark extraction.
What if I don't know the password?
Try extraction without a password first — many payloads (e.g. batch watermarking IDs) aren't encrypted at all. The pre-scan preview on the Detection Results step tells you up front which candidates are encrypted before you even click Decode.
How accurate is the confidence score?
90–100% = HIGH (definite success), 70–89% = GOOD (likely correct), 50–69% = MEDIUM (verify manually), below 50% = LOW/VERY LOW (uncertain). Based on the method's own base reliability, whether decryption succeeded, printable-text ratio, and CTF flag pattern matches.
Can this solve CTF challenges automatically?
Yes for XMP/Custom Key/Object Stream/Embedded File challenges — Auto-detect tries all 6 methods and ranks results by confidence. Whitespace and Incremental Update challenges are also auto-detected, but Whitespace specifically can be destroyed by any PDF re-save that normalizes whitespace, so a miss there doesn't mean nothing is hidden.
What if extraction fails?
Switch to Forensic mode and manually force each method one at a time — Auto-detect already tries all 6, but a manual pass can help you confirm a specific hunch. Check that the PDF isn't itself password-protected (this tool can't open a document-encrypted PDF at all).
Does this work on encrypted PDFs?
No — PDF document encryption (the file's own open password) must be removed first. This tool's own password field is for the SEPARATE, optional AES-256-GCM layer around a hidden payload, not the PDF's own encryption.
Related Tools
PDF Metadata Steganography Hider
Hide text or files in PDF metadata using 6 methods — XMP fields, custom Info keys, object streams, whitespace encoding, incremental updates, and file attachments. AES-256-GCM, batch HKDF watermarking, CTF mode.
Steganography Detector
Statistical steganalysis using four algorithms — chi-square, RS analysis, sample pairs, primary sets. StegExpose-equivalent. Payload size estimate. Method fingerprint. WAV audio support. No upload.