What's actually inside a PDF

You don't need to know how a PDF works to use one. But many of the format's frustrations, the text that copies out scrambled, the 30 MB file with ten pages, the content that was supposedly deleted and is still there, make sense once you know what the file actually contains. (For how the container came to be designed this way, there's a short history.)

A page is a drawing, not a document

Inside the file, each page is a content stream: a list of drawing instructions. Move here. Set this font at this size. Draw these glyphs. Draw this rectangle. Place this image in this box. The format has no concept of paragraphs, columns, tables or reading order; a page is marks placed at coordinates, in whatever order the producing software emitted them.

A lot follows from that one fact. Text extraction has to reconstruct sentences from the geometry of the marks, so copied text comes out wrong in such specific ways. Layout is pixel-perfect on every device because nothing reflows, and for the same reason PDFs read badly on small screens. And "editing" a PDF is closer to editing a poster than a Word file, so even good editors work by covering and redrawing rather than rewrapping.

Fonts travel with the file

For the drawing to look identical everywhere, the file carries its own typefaces. Usually it embeds a subset: only the glyphs actually used, renamed to something like ABCDEF+Garamond. Subsetting keeps files small, with one side effect: a subset has only the characters the document already contains, which is one reason adding new text in a different tool can end up in a substitute font. Fonts add weight, too: a document carrying four weights each of three typefaces can spend more on fonts than on its words by orders of magnitude.

Images are objects, and usually the bulk of the bytes

Every picture in a PDF is a stored image object placed by the content stream, at whatever resolution the source happened to have. Nothing downsamples on the way in: a 4000-pixel photo placed two inches wide keeps all 4000 pixels. That is where oversized PDFs come from, and it is why compression can shrink a file 10× without touching the text: it re-encodes these objects at the resolution the page actually displays and leaves every other part of the file alone.

The layers you can't see

Beyond the pages, the container holds more than most people suspect, and all of it ships when the file does:

• Metadata, twice: an info dictionary (author, title, creating software, dates) and an XMP stream repeating and extending it. Between them they record whose machine made the file and with what. Stripping it takes seconds.
• Annotations: comments, highlights and stamps live in a layer floating above the page, each carrying its author name and timestamps. Form fields are annotations too, which is the root of the filled-form-arrives- blank bug, and why flattening, pressing that layer into the page, fixes it.
• Attachments, JavaScript, layers: a PDF can carry whole embedded files, scripts that run on open, and optional content groups toggled on and off. The privacy scanner exists to list which of these your file actually contains.

Deleted doesn't always mean gone

The format allows incremental updates: instead of rewriting the file, software may append the changes to the end and leave the original bytes in place. It makes saving fast and enables some signature workflows, and it means a file's history can still be inside it. The infamous version is the black rectangle drawn over a name: the rectangle is one more drawing instruction, and the name's glyphs are still right there in the content stream for anyone who copies the text. Real redaction removes the instructions themselves and rebuilds the file so nothing of the original remains.

Putting it to use

Knowing the parts turns vague trouble into a specific fix. A scan that yields no text contains no text, and OCR adds some. Oversized files nearly always carry oversized image objects, which compression re-encodes. A form that arrives blank stored its answers without their appearance, and flattening draws them in permanently. These are consequences of how the container works, and each has a tool built for it.