Remove Excel metadata.

What spreadsheets reveal

Excel workbooks carry many of the same metadata categories as Word documents — author, company, last-modified-by — but spreadsheets have additional categories that are particularly leaky:

• Named ranges with external file paths: if you ever pulled data from another workbook, the path to that file is often stored as a named range. This can reveal your entire network drive structure.
• External data connections: URLs and credentials for database connections, web queries, and Power Query sources.
• Cell comments and threaded comments: contain author names, timestamps, and discussion threads — sometimes containing internal decision-making that shouldn't leave the organization.
• Hidden sheets and hidden columns: not removed by this tool (those are content, not metadata) but worth checking manually.
• Embedded images: charts and logos pasted into workbooks retain their EXIF.

What our tool removes

• Core properties (creator, lastModifiedBy, created, modified, revision, title, subject, keywords)
• App properties (Company, Manager, Template, TotalTime, Application)
• Custom properties (custom.xml — often CRM/DMS metadata)
• Threaded comments and comment files
• EXIF from JPEGs embedded in xl/media/

What our tool does not touch

• Cell values, formulas, formatting
• Chart data and chart styling
• PivotTables and PivotCaches
• Named ranges that are part of formulas (we don't break your workbook)
• Hidden sheets or columns (those are content; you must un-hide and delete manually)

How to use

1. Drop your .xlsx file above
2. Review the field list in the inspector
3. Pick a preset (Privacy or Maximum Privacy)
4. Download the cleaned workbook
5. Optionally download the audit report

Inside an .xlsx file

Like Word documents, Excel workbooks are ZIP archives of XML parts. Rename an .xlsx to .zip and you will find the workbook's metadata in the same docProps/ folder, alongside the sheets themselves:

budget.xlsx
├── docProps/
│   ├── core.xml      ← author, lastModifiedBy, dates
│   ├── app.xml       ← company, manager, application
│   └── custom.xml    ← injected enterprise properties
└── xl/
    ├── workbook.xml      ← sheet structure, defined names
    ├── sharedStrings.xml ← all text values
    ├── comments1.xml     ← cell comments (author + text)
    └── media/            ← embedded images / logos

The named-range leak that's unique to spreadsheets

Spreadsheets carry a category of metadata that documents and presentations do not: defined names with external references. When you pull data from another workbook — even once, even years ago — Excel can store a defined name that records the full path to that source file. In xl/workbook.xml it looks like this:

<definedName name="LastYear">
  '[\\fileserver\finance\2024\Q4-actuals.xlsx]Sheet1'!$A$1:$M$60
</definedName>

That single line exposes your internal server name, the folder hierarchy, and the naming convention of confidential files — none of which is visible anywhere on the spreadsheet grid. It is one of the most overlooked disclosure routes in shared financial models.

What the cleaner removes, and what it deliberately keeps

The cleaner empties the author, company, and date fields in core.xml and app.xml, deletes custom.xml, removes comment parts, and strips EXIF from embedded images. It deliberately does not touch defined names that are part of working formulas, cell values, or formatting, because altering those would change your calculations. If a defined name points to an external path you want gone, remove that reference in Excel first (Formulas → Name Manager), then run the cleaner.

The size relationship

Because metadata is a small fraction of a workbook's bytes (the bulk is in sharedStrings.xml and the sheet data), cleaning changes the file size only slightly. After unzipping, scrubbing, and re-zipping, the cleaned size is approximately:

cleaned_size ≈ original_size − metadata_bytes ± recompression_delta

The recompression_delta is small and can be positive or negative, because the archive is re-compressed with standard DEFLATE settings that may differ slightly from how the original was packed. Your data, formulas, and formatting are unchanged.

A worked example: before and after

Excel keeps its document properties in docProps/core.xml and docProps/app.xml, exactly like Word. But the more interesting leak is in xl/workbook.xml, where defined names can carry full external file paths. Here is a workbook's metadata before and after cleaning, including a named range that exposes an internal server.

<!-- docProps/core.xml -->
<dc:creator>r.thompson</dc:creator>
<cp:lastModifiedBy>cfo-office</cp:lastModifiedBy>

<!-- docProps/app.xml -->
<Company>Northwind Capital</Company>

<!-- xl/workbook.xml -->
<definedName name="LY">
 '[\\fs01\finance\2024\actuals.xlsx]P&L'!$A$1
</definedName>

<!-- docProps/core.xml -->
<dc:creator></dc:creator>
<cp:lastModifiedBy></cp:lastModifiedBy>

<!-- docProps/app.xml -->
<Company></Company>

<!-- xl/workbook.xml (defined name kept;
     remove in Excel if path-bearing) -->

The author username, the CFO-office account, and the company name are all cleared from the property files. The defined name is shown here because it illustrates the most spreadsheet-specific risk: that single line exposes a server name (fs01), a folder hierarchy, and the existence of a confidential file. The cleaner does not automatically delete defined names because doing so can break formulas — see the note below on how to remove path-bearing names safely in Excel.

Complete Excel metadata field reference

* Defined names are kept because deleting one that a formula depends on would break your workbook. Remove path-bearing names yourself via Formulas → Name Manager, then run the cleaner.

How this has actually burned people

How to remove a path-bearing defined name in Excel

Because the cleaner deliberately preserves defined names to avoid breaking formulas, here is how to remove a risky one yourself before cleaning:

• Open the workbook and go to Formulas → Name Manager.
• Look for any name whose "Refers To" value contains a path in square brackets, like [\\server\folder\file.xlsx].
• If the name is not used by any live formula, delete it. If it is in use, replace the external reference with a local value or a copy of the data, then delete the link.
• Save, then run this cleaner to remove the remaining document properties.

How to verify the file is clean

• In Excel: File → Info → Properties shows Author, Last Modified By, and Company; confirm they are blank.
• By unzipping: rename a copy to .zip and inspect docProps/core.xml and docProps/app.xml in a text editor.
• Confirm docProps/custom.xml is gone from the archive.
• The audit report records a SHA-256 hash of the cleaned workbook.

Frequently asked questions

Want the deeper background? Our guide on what spreadsheets leak — authors, comments, and hidden network paths explains the defined-name network-path risk in detail, and the metadata removal algorithms guide covers exactly how the OOXML cleaning works.