You can often tell if a PDF has been edited by checking its producer and dates, comparing two sets of metadata, looking for saved earlier versions inside the file, and checking any digital signature. But most of these clues can be faked or simply missing, so only a signature comes close to proof. Here's where each clue lives and what we found when we tested real files.
Sometimes. A PDF can carry several kinds of evidence about its history, but none of them is guaranteed to be there, and most can be changed by anyone who knows where to look. Treat what you find as clues rather than proof. Here's what to check, roughly from easiest to most reliable:
| Where to look | What it can tell you | Limits |
|---|---|---|
| Producer and Creator | The program that made the file, and the one that last saved it | Easy to change; blank on many PDFs |
| Creation and modification dates | When the file was made and last saved | Editable in any metadata tool, including ours |
| XMP metadata | A second copy of the dates and producer, plus a save history in some apps | Only written by some programs; can disagree with the first set |
| Incremental updates | Changes appended to the end of the file, with the older version still inside | Only if the editor appended instead of rewriting |
| Digital signature | Whether anything changed after signing | Only exists on signed files |
| What you can see | Mismatched fonts, uneven spacing, white boxes, text that won't select like the rest | Needs a careful look, and a clean edit can hide it |
The only clue that's built to be trusted is a digital signature. Everything else tells you what a file says about itself.
Every PDF can have a small information block with a title, author, the creating program ("Creator"), the program that wrote the PDF ("Producer"), and creation and modification dates. You can see it in Acrobat under File, then Properties, or by loading the file into our PDF metadata editor, which also flags whether an XMP block is present.
The useful question is whether the fields fit the story you've been told. A bank statement whose producer is a free online editor, or a contract "signed in March" with a modification date in June, deserves a closer look. To see what editing does, we added one line of text to two PDFs with pdf-lib, the open-source library behind many browser PDF tools, including several of ours. Both times the Producer changed to "pdf-lib" and the modification date jumped to the moment we saved. The Creator and the creation date stayed the same.
Then the giveaway. One file was a brand guide made in InDesign, and its XMP block, the second copy of the metadata, still said "Adobe PDF Library 16.0.3" with a 2022 modify date. The two sets of metadata now disagreed by four years. Tools that update one block and forget the other leave exactly this kind of mismatch, so compare both.
Less common than people assume, which is why missing data proves nothing. We checked 37 unique PDFs from our own files: reports, manuals, brand books and exported documents.
| What we found | Files |
|---|---|
| Had no creation or modification date at all | 18 of 37 |
| Had a creation date | 19 of 37 |
| Modification date different from creation date | 5 of 37 |
| Had an XMP modify date | 5 of 37 |
| More than one end-of-file marker | 4 of 37 |
| ...of which were only "fast web view" files | 3 of 4 |
| ...of which held a real later edit | 1 of 4 |
Nearly half had no dates at all, because the program that made them doesn't write any by default. So a missing modification date isn't suspicious on its own, and a matching one isn't a clean bill of health. Our metadata editor will let you type any date you like, and so will plenty of other tools. That's the point: dates are a label, not a lock.
Sometimes, yes. PDF lets a program save changes by tacking them onto the end of the file instead of rewriting it. The original stays inside, followed by the update. Every saved version ends with a %%EOF marker, so a file with more than one may hold an earlier version.
Be careful with that rule, though. In our sample, 3 of the 4 files with two markers were just "optimized for fast web view," a layout that always uses two. Only one had a real later edit. It was a 12-page product brochure with 5.8 KB appended to the end, saved two minutes after the first version. When we cut the file back at its earlier marker, the earlier version opened fine, and the difference showed: the back cover with the print details had been page 1. The update moved it to the end.
Tools that rewrite the whole file, as most browser editors do, leave no older version behind. So one end marker doesn't mean a file was never edited.
A digital signature locks a fingerprint of the file as it was at signing. Open a signed PDF in Acrobat Reader and the signature panel tells you whether the document has been changed since. If later changes were allowed, such as filling in a form or adding another signature, it lists them as revisions, and you can open the version that was actually signed.
That only works for real certificate-based signatures. A picture of a signature pasted onto a page proves nothing about edits. Our guide to signing a PDF online explains the difference.
Look at the document itself, zoomed in. Fonts that are slightly different in one line, numbers that don't sit on the same baseline, uneven spacing, or a white box with text on top of it all point to a patch. Try selecting the text. If one figure selects separately from the line around it, it may have been added later. If the page is an image but one number is selectable text, that's a strong sign too.
When you have the version you were originally sent, the quickest test is to compare the two PDFs side by side. Any changed word or moved line shows up immediately. Our guide on comparing two PDF files covers text and visual diffs.
And if you're the one sending a PDF, remember the same clues work against you. Clear out the author, software and dates with the document metadata remover before you share.
Check the document properties for the producer and dates, compare them with the XMP metadata, look for more than one %%EOF marker, and zoom in for mismatched fonts or spacing. If the file is digitally signed, the signature panel in Acrobat Reader shows whether it changed after signing. None of these clues is proof on its own.
Usually. When we edited PDFs with pdf-lib, the modification date updated and the Producer changed to pdf-lib. But the date is easy to set by hand, and many PDFs have no dates at all.
Only in part. Some programs record saves in the XMP metadata, and files saved with incremental updates keep earlier versions inside. Most browser editors rewrite the whole file and leave no history.
Yes. The author, software and dates can be changed in any metadata editor, so they're clues, not evidence. A digital signature is the only built-in way to show a file hasn't changed.
No. In our check of 37 PDFs, 18 had no dates at all, because the software that made them doesn't write them. A missing date tells you very little.