Remove Metadata from Excel: What Your XLSX File Is Secretly Sharing

The Spreadsheet That Cost Barclays 179 Contracts

In September 2008, as Lehman Brothers collapsed, Barclays Capital was racing to finalize a purchase of selected Lehman assets. The deal terms were documented in an Excel spreadsheet — rows tagged with an "n" to mark contracts not included in the deal were simply hidden, not deleted. A junior associate at Cleary Gottlieb Steen & Hamilton, working hours before a midnight bankruptcy court deadline, converted the file to PDF. During the conversion, he globally resized the rows — and the hidden rows became visible, their "n" designations stripped away.

The result: Barclays' court filing committed them to 179 contracts they had never intended to acquire. The error was discovered after US Bankruptcy Judge James Peck approved the deal. The subsequent legal battle over those contracts dragged on for years.

This is the most famous Excel hidden-data disaster on record. But it's not really about hidden rows — it's about a fundamental property of XLSX files that almost nobody thinks about: what you don't see on screen is still in the file. Hidden rows, hidden sheets, author names, revision history, external data connections — all of it travels with the spreadsheet when you hit Send. Learning how to remove metadata from Excel before you share is the only reliable fix.

What's Actually Inside Your XLSX File

An XLSX file is, technically, a ZIP archive. Rename it from .xlsx to .zip and you can open it in any archive tool to see what's inside: XML files, relationship definitions, embedded images, and a docProps folder containing your metadata. Most people never look at this layer. Here's what it contains.

Document Properties — The Obvious Layer

The docProps/core.xml file stores the standard document properties block. These fields are populated automatically by Excel from your Microsoft account or Windows user profile the moment you create a file:

• Author — the name of whoever created the file (your full name as registered in Office)
• Last Modified By — the last person to save the file
• Created and Modified timestamps — when the file was first created and last saved
• Revision number — a counter that increments with every single save; a value of 83 tells the recipient the document went through 83 save cycles

The docProps/app.xml file adds application-level properties: the Company name from your Office license registration, the Manager field if set, the application name and version that created the file ("Microsoft Excel for Microsoft 365" or "Microsoft Excel 2019"), and the total editing time in minutes. That last one is more revealing than it sounds — a file showing 4 minutes of editing time when the content suggests hours of work tells a story about how the data was assembled.

Hidden Rows, Columns, and Sheets — The Structural Layer

Excel lets you hide rows, columns, and entire worksheets. The data is still in the file — it's just not rendered on screen by default. Anyone who receives your spreadsheet can unhide it in two clicks: right-click a row header, select "Unhide." For very hidden sheets (set via VBA with xlSheetVeryHidden), it takes slightly more effort, but it's still completely accessible.

This is exactly what happened in the Barclays case. The "hidden" designation protected nothing — it was a display setting, not a security control. If your spreadsheet has draft calculations in hidden rows, preliminary pricing in a hidden column, or a lookup table on a hidden sheet that you didn't want the client to see, the recipient can access all of it.

Comments and Annotations — The Collaboration Layer

When multiple people review a spreadsheet using Excel's comment feature, those comments embed the reviewer's display name alongside the comment text. A comment saying "Check this with legal before sending" — from a person whose name is attached — tells the recipient a great deal about your internal review process. Comments are preserved in the file unless you explicitly delete them.

Defined Names and Formula References — The Data Lineage Layer

This is the layer that most guides don't cover. Excel's Named Ranges feature lets you assign names to cells or ranges — instead of writing =Sheet1!$A$1:$A$100 everywhere, you can write =SalesData. Those defined names are stored in the workbook. When a formula references an external workbook, Excel stores the full file path in the defined names table.

That means a formula like ='C:\Users\jsmith\Finance\[Client_Contracts.xlsx]Sheet1'!A1 doesn't just pull data — it leaves a forensic record of your internal directory structure, your Windows username (jsmith), and the existence of a file called Client_Contracts.xlsx in your Finance folder. The data connection might be broken (the external file might not even be included), but the path string sits in the workbook's XML until you explicitly remove it.

Power Query Connections — The Database Layer

Power Query is Excel's built-in data transformation tool, and it's where the most sensitive hidden data often lives. Every Power Query query is stored in full in the workbook — including the complete M-language query source. Those queries frequently contain:

• Internal database server names and instance paths
• Database names and schema references
• API endpoints including internal URLs
• SharePoint or OneDrive paths
• Sometimes — in older or carelessly configured queries — authentication parameters

A recipient who opens your Excel file in a text editor (or renames it to .zip) can read every Power Query definition verbatim. This is documented in the xl/customXml folder of the XLSX archive. If you built a report by querying your company's internal SQL server at sql-prod-01.internal.company.com\Finance and then shared that report externally, that server address is now in the hands of whoever received the file.

How to Use Document Inspector (Step-by-Step)

Microsoft built Document Inspector specifically to find and remove hidden data from Office files. It's the right first step, though it has gaps we'll cover afterward. Here's how to use it.

Step 1: Open your Excel workbook. Go to File > Info. In the center panel, you'll see a section called "Inspect Workbook." Click Check for Issues, then select Inspect Document.

Step 2: Document Inspector opens with a checklist of categories. Leave all boxes checked for a thorough inspection — they cover comments and annotations, document properties and personal information, custom XML data, headers and footers, hidden rows and columns, hidden worksheets, invisible objects, and external data connections.

Step 3: Click Inspect. Excel scans the workbook and returns a results panel showing what it found in each category.

Step 4: For each category that shows results, click Remove All to delete that data. Do this for every category that's relevant to your use case.

Step 5: After removing, click Reinspect to verify the file is clean. Save the file.

What Document Inspector Misses

Document Inspector is a useful first pass, but it has documented gaps. It handles the obvious metadata fields and obvious structural elements, but it doesn't fully address:

• Defined names with external references — file path strings embedded in named ranges aren't always caught
• Power Query full definitions — Document Inspector can remove inactive data connections but leaves Power Query M-code intact in many cases
• Custom XML parts — while it lists custom XML, it doesn't always remove all custom XML data added by third-party add-ins
• Document statistics — the total editing time counter in app.xml is often not reset to zero

For most business use cases — sharing a pricing spreadsheet with a client, sending a budget to a partner — Document Inspector gets you 90% of the way there. For situations where the metadata risk is higher, you need an additional step. Our guide to hidden data risks in business documents covers why this matters across file formats.

The Windows Properties Panel — Fastest Option for Simple Files

If you don't need to clean hidden rows and sheets — just the document properties metadata — Windows has a faster route. Right-click the Excel file in File Explorer, select Properties, then click the Details tab. You'll see fields like Author, Company, and Last Modified By. At the bottom, click Remove Properties and Personal Information. A dialog gives you two options: create a cleaned copy with all properties removed, or remove specific properties from the current file.

This method clears document property fields quickly, but it only addresses the docProps layer. It doesn't touch hidden sheets, comments, Power Query definitions, or defined names. Use it for quick property cleanup on simple files; use Document Inspector when the structural content matters.

Using MetaClean to Remove Excel Metadata

For a faster workflow — and to catch metadata that Document Inspector leaves behind — MetaClean's Excel metadata tool handles XLSX files entirely in your browser. Nothing is uploaded to any server; the processing happens locally using the same XLSX ZIP-parsing approach, reading and rewriting the docProps XML files and other metadata layers directly.

The process takes under 30 seconds: go to metaclean.app/xlsx-metadata, drop in your file, review the metadata fields that are displayed, click to remove them, and download the clean version. You can also process multiple spreadsheets at once using the batch Office metadata tool — useful when you're cleaning a full set of files before sending a document package.

For high-stakes situations — legal documents, financial models shared externally, any spreadsheet that touches client-sensitive data — combining Document Inspector with MetaClean gives you coverage of both the structural layer (hidden content) and the metadata layer (property fields and path references). The complete workflow is covered in our metadata removal guide for Office documents.

When Excel Metadata Actually Matters

Most of the time, metadata in a shared spreadsheet is a minor inconvenience, not a crisis. But there are specific situations where it crosses into genuine risk.

Sharing pricing or bid spreadsheets with clients: The revision counter tells the client how many iterations your pricing went through. A count of 40 suggests significant internal negotiation before they saw the number. The Last Modified By field shows who had final say. These signals can be used in price negotiations.

Financial models sent to investors or acquirers: Power Query connections that reveal internal database names, server paths, or system architecture are more information than you intended to share. File path references in defined names can expose internal team structures and naming conventions.

Template files distributed to partners: If your template was built by pulling from internal systems via Power Query, and you distribute that template with the queries intact, you've handed external parties a map of your internal infrastructure.

Legal and compliance documents: As we've covered in our analysis of author metadata in legal files, document properties can reveal who was involved in drafting and review — information that can have discovery implications.

Academic and competitive submissions: Many tender documents and academic submissions require anonymized files. Excel metadata breaks anonymization just as reliably as PDF metadata does.

Best Practices Before You Share

Build these steps into any workflow that involves sharing Excel files externally:

1. Always work on a copy before cleaning. Document Inspector's removals can't be undone. Keep your working file intact and clean the copy you'll send.

2. Run Document Inspector on the final version. Not the version you've been editing — the version that's actually ready to send. Late-stage edits can reintroduce metadata.

3. Check for Power Query queries before sharing externally. Go to Data > Queries & Connections. If you have queries defined, check whether they contain internal server names or paths you don't want to share. Either remove the queries, or disconnect and delete them before distribution.

4. Review defined names. Go to Formulas > Name Manager. Look for any names that contain external file path references. Delete the ones you don't need in the distributed version.

5. Verify with MetaClean after cleaning. Run the cleaned file through MetaClean to see what the metadata layer looks like to a recipient. What you see is what they see.

Frequently Asked Questions

Does Excel automatically save my name in every spreadsheet I create?

Yes. Excel populates the Author field using the name registered in your Microsoft account or Windows user profile the first time you save a file. The Last Modified By field updates to whoever saves the file most recently. Both fields are readable by any recipient who checks File > Properties in Excel or opens the XLSX as a ZIP archive to inspect core.xml directly.

Can hidden rows and sheets be seen by someone I share the file with?

Yes, easily. Hidden rows and columns are visible after a simple right-click > Unhide. Hidden worksheets can be revealed through Format > Hide & Unhide > Unhide Sheet. Even "very hidden" sheets set via VBA are accessible through the Visual Basic Editor. Hiding content in Excel is a display setting, not a security control — it prevents casual viewing, not deliberate inspection.

What is the Document Inspector and does it remove all hidden data?

Document Inspector is Microsoft's built-in tool (File > Info > Check for Issues > Inspect Document) that scans workbooks for hidden data including comments, document properties, hidden rows and sheets, and external data connections. It removes most standard metadata but has gaps: Power Query M-code definitions and some defined names with external file path references are not always fully cleared, so a secondary tool like MetaClean is recommended for sensitive files.

What is the Barclays Lehman Excel case?

In September 2008, a junior lawyer converting a Barclays Excel deal file to PDF for court submission globally resized the rows, causing 179 previously hidden rows to become visible. Those rows represented contracts Barclays had marked as excluded from the deal. Because the conversion exposed the hidden data without the original exclusion markings, the court filing committed Barclays to those contracts — a dispute that led to a prolonged legal battle. It's the most cited real-world example of Excel hidden-data risk.

Do Power Query connections expose my internal systems when I share a file?

They can, yes. Power Query stores the full M-language query definition inside the XLSX file, which includes any server names, database names, internal URLs, or API endpoints the query was built against. A recipient who renames the .xlsx to .zip can read these definitions in plain text from the xl/customXml folder. If your workbook was built by querying internal databases, review and remove the queries before external distribution.

Is there a way to remove Excel metadata without losing my data?

Yes. Both Document Inspector and MetaClean remove metadata fields and structural hidden content while leaving your visible spreadsheet data intact. The only exception is that removing hidden sheets also deletes the data those sheets contain — which is why working on a copy before cleaning is essential. Your formulas, values, formatting, and visible content are unaffected by metadata removal.