How to Tell If a PDF Has Been Edited

This comes up in disputes, in due diligence and in fraud checks: is this invoice, contract or certificate the document it claims to be?

Start with the metadata

1. 1Open document properties in any reader.
2. 2Compare the creation and modification dates. A modification date later than creation means the file was saved again.
3. 3Look at Producer. A document supposedly generated by an accounting system that reports a PDF editor as its producer is worth a question.
4. 4Check for two different tools listed as Creator and Producer, which often indicates a document that was made in one place and altered in another.

None of this is proof. Metadata can be edited, and many legitimate workflows re-save a document. It tells you where to look.

Check for a digital signature

This is the only conclusive test. A signed PDF carries a cryptographic hash of its contents; any subsequent change breaks it, and every mainstream reader reports the signature as invalid. A valid signature is strong evidence the document is exactly as signed.

Most documents are not signed, which is why the other checks exist.

Visual inconsistencies

• A number or name in a slightly different font or weight from its neighbours.
• Text baselines that do not align across a line.
• A patch of background that is a marginally different white, where something was covered.
• Spacing around one figure that differs from the rest of the column.
• A page whose dimensions differ from the others, suggesting a replacement.

Zooming to 400% on a suspect figure is remarkably effective. Altered text rarely matches the original rendering exactly.

Compare against a known copy

If you have the original — from the issuer, from an archive, from your own records — a comparison tool will show you every difference directly. That is faster and far more reliable than inference from metadata.

The limits

A careful alteration on an unsigned document, saved as a fresh file with cleaned metadata, can be undetectable from the file alone. When it matters, verify with the issuer rather than with the document. For a formal dispute, a forensic examiner has tools and standing that a reader does not.