What metadata does a .docx file actually contain?

Published 19 August 2026

A .docx file is a ZIP archive of XML parts — rename one to .zip and your operating system will open it directly, no special tool required. Metadata lives in specific, predictable parts of that archive, and one of them is far more dangerous than the properties panel Word shows you.

docProps/core.xml: who, and when

This part holds the fields "Document Properties" surfaces in Word's own UI — creator, last modified by, revision count, created and modified timestamps, title, subject, description, category, content status and keywords. A trimmed real example looks like this:

<cp:coreProperties>
  <dc:creator>J. Smith</dc:creator>
  <cp:lastModifiedBy>J. Smith</cp:lastModifiedBy>
  <cp:revision>14</cp:revision>
  <dcterms:created>2026-03-11T09:22:00Z</dcterms:created>
  <dcterms:modified>2026-08-14T16:05:00Z</dcterms:modified>
</cp:coreProperties>

Fourteen revisions and a five-month span between creation and last save — from three lines of XML nobody reads directly, before the document's actual content has been considered at all.

docProps/app.xml: the organisation behind it

A separate part holds fields Word's Info panel tucks further away: company, manager, the template the document was built from, and total editing time in minutes. A template name in particular can identify an internal or client-specific template even after every visible trace of it — a logo, a footer — has been deleted from the document body.

word/document.xml: the one that ends careers

This is the document's actual content — and if track changes was ever turned on, it's also where deleted text survives. Accepting or rejecting changes in Word's UI only changes what's displayed; the underlying markup can still exist until something explicitly strips it. A tracked deletion looks like this in the raw XML:

<w:del w:id="14" w:author="J. Smith" w:date="2026-06-02T11:40:00Z">
  <w:r>
    <w:delText>the client already knows about the delay</w:delText>
  </w:r>
</w:del>

The visible document reads as if that sentence never existed. The file still contains it, word for word, with an author name and a timestamp attached — which is exactly the shape of leak that ends up in discovery during litigation, or in a redacted-looking document that wasn't. Tracked insertions are wrapped the same way, in <w:ins>; formatting changes and moved text carry their own author-tagged wrappers too, all cleared by the same pass.

word/comments.xml and settings.xml: two quieter leaks

Comment threads live in their own part, each entry carrying an author name and timestamp independent of whatever's visible in the document body — easy to overlook since a resolved or deleted comment thread simply isn't rendered, not because it's gone. Separately, settings.xml holds revision session identifiers (RSIDs) — short hex tags stamped onto edits within a single editing session, that persist even after "Accept All Changes" removes the visible tracked-change markup, and that can link two documents together if they share editing sessions.

The part with no properties UI at all

Some .docx files carry docProps/thumbnail.jpeg — a rendered preview of the first page, embedded for file browsers and "recent documents" lists to show without opening the file. It's a binary image, not a text field, so it has no corresponding checkbox in any properties dialog. A thumbnail generated before a page was edited or redacted can keep showing that page's original contents regardless of what the document body says now.

Why "Save As" doesn't help

None of these parts get regenerated from scratch by routine editing. "Save As" and "Duplicate" both carry the original core properties forward unless a template explicitly resets them; only building a new document from a blank template starts fresh. A company template with a founder's name hardcoded into its own core.xml, saved years ago, stamps every document created from it the same way, forever — until someone edits the template itself, not the documents it produces.

Clean one

This site's Word tool clears every part described here — properties, comments, tracked-change authorship, revision identifiers and the embedded thumbnail — while leaving styles, fonts, images and the document's actual content untouched. See the document formats hub for how the same risk shows up in Excel, PowerPoint and PDF.