How PDF files actually work

On the outside a PDF is one tidy file. On the inside it's a small database of objects that reference each other. Understanding that structure explains a lot about why PDFs behave the way they do.

The four building blocks

• Header — a single line declaring the PDF version, e.g. %PDF-1.7.
• Body — a collection of numbered objects: pages, fonts, images, and content streams that draw text and graphics.
• Cross-reference table (xref) — an index listing the exact byte offset of every object, so a reader can jump straight to any one without scanning the whole file.
• Trailer — points to the document's root and the xref, telling the reader where to start.

Objects and references

Everything is an object: a page is an object that references a content stream object and a resources object (which in turn references font and image objects). This web of references is why deleting a page cleanly, or merging two files, requires rewriting the xref rather than just cutting and pasting bytes.

Content streams

The actual page drawing lives in a content stream — a compact set of instructions like "set this font at 12pt, move to these coordinates, show this text." There are no paragraphs or columns as concepts; there are only positioned glyphs. That's why editing text in a PDF isn't like editing a Word document, where text re-flows automatically.

Incremental updates

PDFs can be edited by appending changes to the end of the file rather than rewriting it — an "incremental update." It's fast and preserves signatures, but it also means old content can linger inside the file. That's an important detail for redaction and removing metadata: to truly delete something you often need to flatten or re-save the whole document.