Fake PDF Detector Tools: What They Check and Miss
This article is a snapshot – content was accurate as of October 2026. The product evolves actively; specific counts, examples, and detection rules may have changed since publication – see the changelog for the current state.
You have a PDF in front of you – a bank statement from a tenant, a payslip from a candidate, an invoice from a supplier you have not paid before – and something about it bothers you. So you search for a fake document detector, and you get a page of tools that all claim to answer the same question.
They don’t. Each tool in that list looks at a different part of the file, and each one misses things another would catch. Picking one without knowing which part it reads is how a document gets ‘checked’ and still gets through.
Short answer: what a fake PDF detector actually does
A ‘fake PDF detector’ is not one kind of tool. Some read the metadata fields, some look at the rendered page, some compare the text against expected values, and some examine the internal structure of the file for signs it was changed after it was created. None of them answers ‘is this document genuine?’ on its own – each answers a narrower question, and the useful choice is the one whose question matches what you need to know about the file.
The six kinds of fake PDF detector
| Kind of tool | What it inspects | Good at | Where it stops |
|---|---|---|---|
| Metadata viewers | Document properties: producer, creator, creation and modified dates | A fast, free look at what the file says about itself | Shows fields without judging them; fields can be rewritten |
| Online ‘was this PDF edited’ checkers | Varies by tool – often metadata, sometimes more | A fast first answer, nothing to install | Depth varies; ask what the result is based on |
| Visual and image-forensics tools | The rendered page and embedded images | Spotting visual anomalies in how the page looks | A cleanly edited PDF can look perfect |
| OCR and content-consistency checkers | The text and figures on the page | Wrong totals, mismatched names, values that don’t add up | Reads what the page says, not how the file was produced |
| Manual review | Everything a trained person can see and cross-check | Context, judgement, calling the issuer | Slow, inconsistent at volume, does not see how the file was built |
| Structural forensics | The PDF’s internal construction and revision record | Whether the file itself was changed after it was created | Says nothing about whether the content is true or who issued it |
The rest of this article takes each row in turn. If you want the step-by-step version – how to do these checks yourself on one file – that is covered in how to check if a PDF has been edited.
Metadata viewers and online edit checkers
A metadata viewer opens the document’s properties and shows you what is there: which application created the file, which one last saved it, when each happened. Our own PDF metadata viewer is free and does exactly this, and for a quick look it is useful. If a statement that claims to come from a bank’s system lists a home word processor as the application that made it, you have learned something in ten seconds. Reading the two dates properly is a skill of its own – see checking a PDF’s creation and modification dates.
The limit is that a viewer displays fields; it does not judge them. A producer field that says the file came from a bank’s statement system is a claim the file makes about itself, and that claim can be edited like any other text. A viewer will not tell you whether the file was changed after it was created. For more on that distinction, see PDF tamper detection vs metadata tools.
Online ‘was this PDF edited’ checkers sit one step further along: you upload a file and get an answer back. Depth varies between tools. Before you rely on any edited PDF checker, ask one question: is the result drawn from the metadata fields alone, or from the file’s structure as well? That tells you which of the questions in this article it is answering.
Visual, AI-image and OCR checkers
These tools work on what the page shows. Image-forensics tools look at the rendered page and its images for visual anomalies. OCR and content-consistency checkers extract the text and figures and test them: does the running balance add up, do the names and dates agree across the document, is the tax consistent with the gross.
This is the class of tool that reads what the document says, so it is where wrong figures and altered values get caught. Structural analysis cannot answer ‘are these numbers right?’, and neither can a metadata viewer.
The limit follows from the same fact. A cleanly edited PDF can look perfect and produce consistent figures. A tool that only reads the rendered page has nothing to object to: it tells you how the document looks, not what happened to the file.
Detecting AI-generated documents is a different question again – whether content was produced by a generative model, not whether an existing file was changed. If that is your concern, we cover what works and what does not in detecting AI-generated PDFs.
Manual review
A person who knows the document type is still the best tool for context. They notice a payslip dated on a Sunday, an employer address that does not match the company register, an account number in the wrong format for that bank. They can phone the issuer. No automated tool does that.
Manual review has three costs. It is slow. It is inconsistent – two reviewers on the same file, or one reviewer at 9am and at 5pm, will not reach the same conclusion every time. And it does not see how the file was built: a reviewer looking at a well-made edit on screen sees the same perfect page the visual tools see. PDF tamper detection vs manual review goes into where each one fits.
What structural forensics adds
Every PDF carries a record of how it was put together – its dates, its revisions, its signature state and how its pages were produced. Structural PDF analysis reads that record and asks one question: was this file changed after it was created?
That is the layer HTPBE? covers. You submit a PDF and get one of three verdicts – intact, modified or inconclusive – and, when something was found, a list of named markers describing what it was. At outcome level, the findings look like this:
- Dates that disagree – the file’s date records do not support the history it presents (
HTPBE_DATES_DISAGREEis one of the public marker IDs). - Edits after signing – content changed after the document was digitally signed (
HTPBE_POST_SIGNATURE_EDIT), or a signature stripped after signing. - Pages from multiple sources – pages assembled from independently produced documents (
HTPBE_PAGES_FROM_MULTIPLE_SOURCES). - Editing-tool traces – fingerprints of a known PDF editor, or the identity of an online editing or conversion service.
- Revision history – the document re-saved after its original creation.
The full list of public markers and what each one means is on how HTPBE? works. The PDF tamper detection page covers the approach in more depth, and viewing a PDF’s edit history explains the revision record itself.
What structure adds is evidence the other classes do not look at. A clean visual edit is still an edit, and the file often records that it happened even when the page looks untouched.
If you have one file and want to see this in practice, start with checking whether a PDF was edited.
What no PDF detector proves, including ours
Be clear about the boundary before you build a decision on any of these tools.
intactdoes not mean authentic. It means the structural analysis found no evidence the file was changed after it was created. It does not mean the content is true, and it does not mean the document was issued by the party named on it. HTPBE? detects modification of the file – not whether what the file says is correct.- HTPBE? does not read the content. It does not run OCR, check arithmetic, compare names or validate figures. That is the job of the content-checking class above.
- It is not identity or issuer verification. It does not confirm who someone is, check a document against an issuer’s records, or perform KYC.
inconclusiveis neither a pass nor proof of fraud. Usually it means the file came from a source – ordinary consumer software, a scan and similar – where a structural check cannot confirm integrity either way; occasionally it means the analysis could not finish, in which case treat the file as unchecked rather than clean. Judge it against the origin the document claims: a statement presented as coming from a bank’s system that returnsinconclusiveneeds a closer look through your other checks, and the safe next step is to request the original from the issuer.- No verdict is a decision. A
modifiedresult is a reason to look more closely or ask questions, not a reason to reject an applicant automatically. Route it to a person.
How to choose: a decision guide
Start from what you are trying to find out, and how many files you handle.
One file, one decision. Open it in a metadata viewer for a first look. Run a structural check to see whether the file was changed after it was created. Read the content yourself against what you already know – names, dates, amounts. If the stakes are high, contact the issuer through a channel you find independently, not one printed on the document.
Recurring volume – a lettings agent screening tenants every week, an HR team checking candidate documents, a small lender reviewing applications. Manual review alone stops scaling, and its inconsistency starts to matter. Put a structural check on every incoming file so reviewers know which ones to open first – files that come back intact still get your normal content review, because the check sets priority, it does not approve anything. Keep content checks for the figures that drive the decision and issuer contact for the cases that warrant it. If you are looking for a fake document detector for a specific document type, the use-case pages show what the check covers for each.
Integration into your own system. If documents arrive through an application form or an upload flow, the check belongs in the pipeline, not in someone’s browser. With the HTPBE? API you submit a PDF URL and fetch the verdict and named markers as JSON, so modified and inconclusive files land in the review queue automatically, alongside the content checks every file still gets.
Frequently Asked Questions
Is there a free fake PDF detector?
Several tools are free for a quick look, including our PDF metadata viewer. For structural analysis, an HTPBE? account comes with 5 free credits at signup – one credit per check – so you can run a few files before paying anything. After that, checks are pay-per-check: $5 for 8 credits or $15 for 25. See pricing.
Can a PDF edit checker tell me what was changed?
Not the specific words or numbers. A structural check tells you whether the file was modified and, if so, what kind of evidence was found – dates that disagree, an edit after signing, pages from different sources. To see which values on the page are wrong, you need to read the content against a trusted source.
Does a PDF integrity checker prove a document is genuine?
No. An integrity check speaks to the file – whether there is evidence it was changed after it was created – not to the facts in it or who issued it. For high-stakes documents, combine a structural check with content review and contact with the issuer.
Can I run a PDF fraud checker automatically on every document?
Yes, through an API. You submit a PDF URL to the HTPBE? API and fetch a verdict with named markers. Subscriptions start at $15 a month. Treat the result as input to your review queue, not as an automatic accept or reject.
Where to go from here
If you are deciding whether to build this layer in-house or use a service, build vs buy PDF tamper detection works through the trade-offs. If you have a file to look at now, create an account and use the 5 welcome credits on it. If documents reach you through your own system, start with the API.