Learn

How to tell if a PDF was modified

A PDF carries its own history. Some of that history is provable. Most of it is only suggestive. This guide walks through both kinds.

The provable signal: a digital signature

If a PDF was digitally signed, the signature covers a precise span of bytes. Change anything inside that span and the signature stops verifying. Add anything after it and the file is longer than the span the signature covers. That second case is called an incremental update, and it is the cleanest evidence that a file changed after signing.

The suggestive signals: metadata

Most PDFs are not signed. For those, you are reading metadata: creation and modification dates, the software that produced the file, and the edit history some tools write. These fields are informational. Any of them can be edited or stripped. They suggest a story; they do not prove one.

What a gap between dates means

A modification date after the creation date is normal for an edited document. A modification date before the creation date is not normal and deserves a closer look. A missing creation date can mean the file was rebuilt by a tool that discards it.

Check a file now

DocVerdict runs these checks in seconds and explains each finding in plain language. The free verdict shows the signature status and the most important finding.