Learn

How to tell if a PDF was modified

There are two ways to tell whether a PDF changed after it was made. If the file is digitally signed, you can get a mathematical answer: the signature either still covers the file or it doesn't. If the file isn't signed, you're reading metadata, and metadata can only suggest a story, never prove one. Most disputes over a document come down to knowing which kind of evidence you're holding.

The provable signal: a digital signature

A digital signature covers a precise span of bytes in the file. Change one character inside that span and the signature stops verifying. That's not a heuristic. It's arithmetic.

There's a subtler case that catches most real-world edits. PDF allows new content to be appended to the end of a file without touching the original bytes. This is called an incremental update. The original signature still verifies, because its bytes are intact, but the file is now longer than the span the signature covers. Someone signed the document, and then someone changed it. The edit may be innocent, a second signature or a saved form field. It may not be. Either way, the timeline is provable: this content arrived after that signature.

The suggestive signals: metadata

Most PDFs are never signed. For those, the available evidence is metadata: a creation date, a modification date, the software that produced the file, and sometimes an edit trail left by specific tools.

Read these fields the way an examiner would. A modification date later than the creation date is normal for any edited document. A modification date earlier than the creation date is not normal and deserves a closer look. A missing creation date often means the file was rebuilt by a tool that discards history. And the producer field, the software that wrote the file, tells you how the PDF reached its current form. A bank statement should say something like a banking platform or a core print system. If it says it came from an online PDF editor, the file you're holding is not the file the bank produced.

None of these fields prove anything on their own. Every one of them can be edited or stripped with free tools. What they give you is a story to test: do the dates, the software, and the document's claimed origin agree with each other? When they don't, you've found the thread to pull.

The signals people miss

Three signals carry more weight than the dates everyone checks first. The number of incremental updates: a file saved many times after its stated creation has a longer life than it admits to. Internal object dates that disagree with the document dates: some tools stamp pages or images separately, and those stamps survive edits to the main fields. And fonts or images that don't match the document's claimed era or source.

What you can check in two minutes

Open the file's properties and compare the dates. Look at the producer and creator fields and ask whether that software makes sense for who supposedly sent the file. If the document is signed, open the signature panel and check whether the signature covers the whole document or only part of it. That last distinction is where most people stop short, and it's exactly where after-signing edits hide.

FAQ

Can a PDF be modified without changing the modification date?

Yes. Metadata fields are just data, and tools exist to set them to any value. That's why a clean modification date is weak evidence of an unchanged file, while a broken signature is strong evidence of a changed one.

Does opening or downloading a PDF change it?

Opening a file doesn't modify it. Some viewers and email systems re-save files, which can update filesystem timestamps without touching the PDF's internal dates. The internal metadata is the more stable record, which is also why examiners read it first.

Is a missing signature suspicious?

No. The overwhelming majority of legitimate PDFs are unsigned. An unsigned file just means your evidence is metadata, so your conclusions should be proportionally careful.