Skip to content
PDFLove

what is inside a pdf file

What's Actually Inside a PDF File

Open a PDF in a text editor and you will find something closer to a database dump than a document. Almost every odd thing PDFs do follows from that one fact.

01

Objects, not pages

A PDF file is a numbered collection of objects. Each one is a dictionary, a stream of bytes, an array, a number or a string, and each has an ID. Objects refer to each other by number: object 3 says "my contents are in object 47", object 47 says "my font is object 12".

One of those objects is the catalogue, the root of everything. It points at a page tree. The page tree points at page objects. Each page object points at a content stream and at a dictionary of the resources that stream needs — fonts, images, colour spaces.

There is no object called "paragraph", and no object called "heading". The structure stops at the page. Everything below that is drawing instructions.

Header
One line: %PDF-1.7. The version determines which features a reader may expect.
Body
The numbered objects. Fonts, images, page definitions, content streams, metadata.
Cross-reference table
A byte-offset index: object 47 begins at byte 91,204. It is how a reader jumps straight to page 900 of a 1,000-page file without reading the first 899.
Trailer
Points at the catalogue and at where the cross-reference table starts. It is the last thing in the file, which is why readers open a PDF by seeking to the end first.

02

The content stream is a list of instructions

Inside a page's content stream is a sequence of operators in postfix notation — the operands come first, then the command. `1 0 0 1 72 720 Tm` sets a text position. `/F1 12 Tf` selects font F1 at 12 point. `(Hello) Tj` draws the string. `re` builds a rectangle, `f` fills it, `Do` paints an image object.

That is the whole model: a painter following orders, top to bottom. The page is what is left on the canvas when the orders run out.

Two consequences follow immediately, and between them they explain a great deal. Order in the stream is drawing order, not reading order — a footnote can be drawn before the body text that references it. And nothing in the stream says what anything *is*. A heading is text that happens to be drawn larger.

03

Why the last section of the file matters most

The cross-reference table is a byte-offset index, and byte offsets are brittle. Change anything in the middle of a PDF and every offset after it moves. This is why editing a PDF in a text editor almost always corrupts it, and why a truncated download produces a file that will not open at all even though 95% of its content arrived intact.

It is also why repair is possible and often successful. When a reader says the file is damaged, it usually means the offsets are wrong, not that the objects are gone. A repair pass ignores the broken table, scans the whole file for anything that looks like an object header, and rebuilds the index from what it finds.

04

Incremental updates: PDFs remember

A PDF can be changed by appending. Rather than rewriting the file, a writer adds the new versions of the changed objects to the end, then adds a new cross-reference table that points at them and chains back to the old one. The reader uses the newest table, so it sees the new version.

The old objects are still in the file. This is deliberate — it is what makes digital signatures verifiable, because you can reconstruct exactly what was signed. It is also a genuine hazard: a redaction done by drawing a black rectangle leaves the text underneath fully intact and extractable, and "deleted" pages often are not.

Saving a PDF fresh, rather than incrementally, discards the history. So does flattening. If a document has been through several rounds of edits, that is worth knowing before you send it out.

05

What this explains

Nearly every complaint about PDFs traces back to the model. Copied text arrives jumbled because content-stream order is drawing order. Converters lose formatting because there was never any structure to convert — only positioned glyphs. Merging is fast and lossless because it is renumbering objects, not re-rendering pages. Files stay stubbornly large because the weight is in image objects, and no amount of removing text touches them.

It is a format designed to guarantee that a page looks identical everywhere, and it achieves that completely. The cost is everything that depends on knowing what the page means.

FAQ

Related questions

Can I open a PDF in a text editor?

Yes, and it is worth doing once. You will see the header, readable dictionaries, and long runs of binary where the compressed streams are. What you should not do is save it — changing even one byte in the middle shifts every cross-reference offset after it and breaks the file.

Why is a PDF that looks simple so large?

Because the size lives in objects you cannot see on the page: embedded fonts, image data at scanner resolution, and sometimes the entire edit history left behind by incremental saves. The visible text is usually the smallest thing in the file.

Does deleting a page delete its content?

It depends on how it was deleted. Removing a page from the page tree and saving incrementally leaves the page object in the file. A proper rewrite drops anything no longer referenced. If the content is sensitive, rewrite or flatten rather than assuming.

What is the difference between PDF 1.4 and PDF 2.0?

Mostly capabilities added over time: transparency in 1.4, object and cross-reference streams in 1.5, AES-128 encryption in 1.6, AES-256 and a cleaned-up specification in 2.0. The underlying object model has not changed since 1993, which is why a reader today still opens a file from then.