2026-07-25

What's actually inside a Word, Excel, or PowerPoint file's hidden properties

A docx, xlsx, or pptx file is a zip archive with a folder called docProps inside it, and that's where "hidden metadata" actually lives — not as one blob, but as three separate XML files, each written for a different reason. Knowing which one holds what matters, because "strip the metadata" gets treated as a single action when it's really three, plus a fourth thing that metadata removal never touches at all. Here's what's actually in each part, and what a tool like NearScrub can and can't reach.

core.xml: the authorship trail

docProps/core.xml is the Dublin-Core-based part, and it's the one most people mean when they say "author metadata." It carries the document's creator name, the last person who saved it (lastModifiedBy), the creation and last-modified timestamps, and a plain incrementing revision number — how many times the file has been saved, full stop, with no record of what changed between saves. None of this is visible in the document body. A resume edited by a recruiter, a contract redlined by three different people, or a personal letter typed at work all carry this trail regardless of what the final visible text says.

app.xml: a fingerprint of the software that made it

docProps/app.xml is different — it's populated by the application, not the author. It holds fields like Company and Manager, the application name and version, the document template in use, and TotalTime, a running count in minutes of how long the file has been open for editing. Company in particular is often auto-filled from the Office installation's registered organization name at setup time, which means a personal document typed on a work laptop can carry the employer's name even though nothing in the visible text mentions it.

custom.xml: whatever an integration decided to write down

docProps/custom.xml holds free-form name/value pairs. A user can add these by hand in Word, but the more common source is software further up the chain: legal document-management systems, contract-assembly tools, and compliance suites commonly write client names, matter or reference numbers, or internal document IDs into custom properties so the file stays searchable once it leaves that system. A file exported from one of those systems can carry an internal reference number that's meaningless to whoever sent it and identifying to whoever it's about.

What none of the three include: tracked changes and comments

This is the part most "remove hidden data" advice skips. Tracked-change marks and comment text don't live in docProps at all — they live in separate parts of the same zip (word/document.xml carries the insertion/deletion marks, comments.xml carries the comment text), because they're document content, not document properties. Microsoft's own Document Inspector treats them as a separate checkbox category from "document properties and personal information" for exactly that reason, and its own documentation is explicit that Inspector alone doesn't remove active tracked changes — they have to be accepted or rejected through Word's Review tools first. A file with its properties cleared can still open with every "deleted" sentence sitting there in the Reviewing pane, because clearing properties and resolving changes are two unrelated operations that happen to live in the same file format.

What NearScrub actually clears

NearScrub's Office handling blanks exactly the three parts above — docProps/core.xml, app.xml, and custom.xml — entirely inside the browser, no upload. That removes the author name, last-modified-by, company, manager, and any custom properties in one pass across docx, xlsx, pptx, and their OpenDocument equivalents. It doesn't touch word/document.xml or comments.xml, so it won't accept tracked changes or delete comments for you — if a file has either, resolve them in the word processor's Review tab first, the same order Microsoft's own tooling requires. After that, running the file through NearScrub clears the property trail Office doesn't offer a one-click way to blank without also touching formatting.