Your Mac remembers where every file came from
macOS attaches extended attributes to files, outside their contents. Downloads get kMDItemWhereFroms, which stores the full source URL and the page you clicked from, query string included. Run xattr -l ~/Downloads/file.pdf and read it yourself.
What an extended attribute is
An extended attribute is a named blob of data the filesystem stores alongside a file, separate from the bytes that make up the file's contents. Nothing in the PDF or the image changes. The information hangs off the file like a luggage tag.
That distinction matters for two reasons. It is why metadata cleaners that rewrite a file's contents can leave this data completely untouched, and it is why the tag survives being copied to another folder or another drive on your Mac while quietly disappearing when a file is emailed or uploaded.
The attributes worth knowing
com.apple.metadata:kMDItemWhereFroms. Usually two entries: the direct URL of the file, and the URL of the page you were on when you downloaded it. Both complete, with every query parameter intact. If you clicked through from a link carrying tracking parameters or a session token, that string is now attached to the file.com.apple.quarantine. The Gatekeeper flag. It records the app that performed the download by bundle identifier, a timestamp, and an event identifier. It is how macOS knows to warn you before opening something from the internet.com.apple.metadata:kMDItemDownloadedDate. When it arrived, to the second.com.apple.metadata:kMDItemFinderCommentandcom.apple.metadata:_kMDItemUserTags. Your Finder comments and colour tags, which are your own notes and often frank.com.apple.provenance,com.apple.lastuseddate#PS,com.apple.FinderInfo, plus sync attributes such as the one Dropbox writes.
Read them yourself
The Finder shows a friendlier version: select a file, press Cmd-I, and look for the "Where from" line under More Info. That view shows the URL but hides the rest, which is why the Terminal version is the honest one.
When this actually leaks
Extended attributes are lost on most upload paths, and that leads people to assume they never matter. The cases where they travel are exactly the informal ones:
- AirDrop preserves them.
- Shared volumes, network drives and disk images preserve them.
- Sync folders such as Dropbox or iCloud Drive carry them between your own machines, and into shared folders.
- Archives. Compressing with the Finder's own Compress command keeps macOS attributes inside the archive, so a ZIP you hand over can contain every download URL of every file in it.
The last one catches people out regularly. A folder of research PDFs zipped and sent to a colleague ships the internal wiki URLs, the paywalled links with your session parameters in them, and the timestamps of when you collected each one.
Clearing them, carefully
Use the targeted form by default. Clearing com.apple.quarantine removes a security check, so stripping it wholesale on files you have not vetted trades a small privacy win for a real risk. Remove the provenance attributes you care about and leave Gatekeeper alone unless you have a reason.
One more tag: the filename
The most portable metadata on any file is its name, and it survives every upload, every attachment and every strip. Common giveaways:
IMG_4021orDSC_0147, which reveal how many photos the camera has taken.Screenshot 2026-05-25 at 14-32-08, a timestamp to the second.- Export names carrying a device label, along the lines of a recording named after someone's MacBook or iPhone.
- Long UUID filenames from an export pipeline, which link the file back to a record in whatever system produced it.
Renaming is the cheapest privacy measure available, and the one nobody does.
File cleaning is coming next to tdy.
tdy is a Mac menu-bar app that already tidies every link you copy. Clearing download provenance, metadata and filename tells before you share a file is on the way. One email when it ships, nothing else.
Join the launch list