A .docx (and its .docm / .dotx variants) is a ZIP of XML parts, and Word writes far more into those parts than the text you see. Unlike a flat PDF, a Word file keeps an editing lineage: every save session, every tracked change, every commenter, plus identifiers that quietly link one document to another. Several of those fields survive even Microsoft's own Document Inspector.
Scan a Word fileA scan pulls the author and last-modified-by names from the document properties, but the more revealing material is the editing lineage. Word tags body content with editing-session IDs (rsids) and records an original creation-session ID (rsidRoot) in settings.xml. Two files that share that rsidRoot came from a common origin, and Microsoft's Document Inspector does not remove it. Every tracked-change author and comment author is listed by name.
Beyond display names, word/people.xml stores stable identifiers - Active Directory SIDs or Microsoft account IDs - for the people who edited the file. These are organisation-wide unique and do not change when someone is renamed. If the document carries a Microsoft Information Protection label, the scan surfaces the label itself (for example 'Confidential'), the account that applied it, and the Microsoft 365 tenant site ID, all of which name the organisation.
Text formatted as hidden stays verbatim in the file and is reported as hidden runs. Header and footer text - a common home for firm names, matter numbers and classification markings - is read out even when the body is redacted. Document variables set by enterprise templates (matter numbers, attorney or project codes) persist because the Inspector does not touch them.
The rest of what a single .docx hands over: the company from the Office install and any manager recorded in the properties, the original save path (usually C:\Users\<name>\...), the attached template path, internal \\server hyperlinks, the document GUID, and a VBA macro project if one is present. Any photos embedded in the document are also scanned for their own EXIF and GPS.
This is a selection. The full field manual documents the fields read from each format.
Author and last-modified-by names, created / modified / printed dates and a revision count, the company and manager from the Office install, tracked-change and comment authors, hidden text, editing-session IDs, the template path, the document GUID, and - if applied - a Microsoft Information Protection label with the tenant it belongs to.
Yes. Beyond the display names, word/people.xml stores Active Directory SIDs or Microsoft account IDs for editors, and settings.xml keeps editing-session IDs (rsids) including the original creation-session ID. These are machine-readable, do not change when someone is renamed, and Word's Document Inspector does not remove them.
No. The Document Inspector removes many fields but leaves the rsidRoot creation-session ID, document variables set by templates, and any hidden text you did not explicitly select. It flags macros rather than deleting them - saving as .docx instead of .docm is what drops the macro project.
Drop the file here to see every field in your browser; nothing is uploaded. File X-Ray can also save a metadata-stripped copy. In Word itself, File > Info > Check for Issues > Inspect Document removes many properties, but re-scan the result because some fields survive.
File X-Ray reads Word files entirely in your browser - the file never leaves your device. For this format you can also download a clean copy with the metadata removed. Scan a file now.