Inspect Word, Excel & PowerPoint Metadata
Modern Microsoft Office files—Word documents (.docx), Excel workbooks (.xlsx) and PowerPoint presentations (.pptx)—look like single files, but each one is actually a structured ZIP archive containing XML parts under the Open Packaging Conventions (OOXML) standard.
Because those XML parts record far more than the visible text on the page, inspecting a document’s package structure can reveal how it was created, which software or library wrote it, and whether hidden worksheets or template references are still attached.
You can inspect Word, Excel and PowerPoint files locally in your browser with the free File Sniff AI evidence & document metadata checker.
What is stored inside an OOXML document?
When an Office file is saved, applications write metadata across several internal XML files:
docProps/core.xml(Core properties): Stores the creator (dc:creator), last person or account to save the file (cp:lastModifiedBy), revision number (cp:revision), creation timestamp (dcterms:created), last-modified timestamp (dcterms:modified), title, subject and keywords.docProps/app.xml(Application properties): Records the creating application name (such asMicrosoft Office Word,Microsoft Macintosh ExcelorLibreOffice), application version, total editing time (TotalTime), template name (Template), company field and page/word/slide counts.docProps/custom.xmlandcustomXml/: Custom property pairs and structured XML parts added by document management systems, enterprise plugins or workflow automation tools._rels/.relsand part relationships: Links to external templates, linked images, hyperlinks and embedded objects.
Hidden sheets, revision sessions and templates
Beyond standard property cards, the package structure holds workflow details that ordinary file-property dialogs rarely show:
- Excel worksheet visibility (
xl/workbook.xml): Excel sheets can be markedvisible,hidden(accessible via the Unhide menu in Excel) orveryHidden(usually set by VBA macros or scripts so the sheet does not appear in Excel’s standard Unhide list). - Word revision sessions and attached templates (
word/settings.xml): Word records revision-save IDs (rsid), compatibility target versions, tracked-change settings, document variables and the path or URL of any attached.dotx/.dotmtemplate. - PowerPoint slide counts vs package parts: Comparing the slide count in
docProps/app.xmlwith theppt/slides/slide*.xmlfiles inside the ZIP package highlights unusual export behaviour or unreferenced parts. - ZIP entry timestamps: Standard desktop apps write current timestamps as parts are saved, whereas some automated scripts and document generators write uniform or fixed default-era (
1980-01-01) ZIP timestamps across every entry.
What metadata can—and cannot—tell you about AI or automation
People often wonder whether an Excel spreadsheet, Word report or slide deck was generated by an AI assistant or an automated script. Inspecting the OOXML package provides concrete clues, along with clear limits:
- Direct tool or library markers: Code-execution environments and automation pipelines frequently generate files using Python or JavaScript libraries such as
openpyxl,XlsxWriter,python-docxorpython-pptx. Some leave library names, default author strings or characteristic property combinations (such as an empty creator, unincremented revision counter or uniform ZIP timestamps). - Why clues are never proof of AI: Those same libraries are used every day by human developers, financial analysts and reporting systems that have nothing to do with AI. Conversely, if someone generates a file with an AI tool and then opens and saves it once in desktop Word or Excel, Office overwrites many of those properties with normal desktop metadata.
- Formatting is not a fingerprint: Common fonts (such as Calibri, Aptos or Arial) and standard colour palettes overlap with built-in templates and library defaults. They cannot reliably identify ChatGPT or any other model.
To examine a .docx, .xlsx or .pptx file without uploading it anywhere, use the AI evidence & document metadata checker, or use the file type checker if you need to confirm what container format a file uses first.