PDF Generator Fingerprints: What Software Made This PDF, and Why We Keep Our List Private

Two bank statements land in your underwriting queue. Both look like they came from the same bank. Both open cleanly. Both show the account holder you expect. One was issued by the bank’s own systems. The other passed through different software on its way to you. From the outside, they are indistinguishable. From the inside, they were made differently, and the software that made them left something of itself behind.

That is true of every PDF. This article is about the generator side of that fact: the platforms, office suites, browsers, print drivers and libraries that create PDFs, what their involvement means for someone reviewing a document, and why HTPBE? knows more about it than it publishes.

Where PDFs come from

A PDF is rarely typed into existence by a person. It is produced by software, and the kind of software says something about the document’s life:

• Business systems that issue documents directly: payroll, billing, banking, insurance and government platforms.
• Office suites and browsers that export or print a document to PDF.
• Print drivers and converters that turn another format into PDF.
• Programming libraries that assemble documents from code.
• Scanners and phone apps that turn paper or a photo into a file.

Each of these writes a file in its own way. The visible part is the document properties, which usually name the application that created the file and the one that wrote the PDF. You can read them yourself in any viewer or with the free PDF metadata viewer, and our reference to PDF metadata fields explains what each one means.

How to see what software a PDF names

Open the file in Acrobat or a browser and look at its document properties. Two fields name software: the creator, which is the application the document was authored in, and the producer, which is whatever wrote the PDF itself. Or drop the file into the PDF metadata viewer and read both without installing anything.

A name in the properties is a claim, not evidence

Those fields are text inside the file. A name there tells you what the file says about itself. It does not tell you that the file was really made that way, and anyone can change it. That is why a tool name alone never decides a verdict in HTPBE?. It is context for a human reviewer, shown in the result, and nothing more.

A tool name is one small part of what HTPBE? looks at, and on its own it settles nothing. We do not describe what else is considered or how it is weighed.

What the origin means for a reviewer

The origin of a document changes what you can reasonably ask of it.

If a document comes from a system that issues documents of that kind as a matter of course, there is a genuine original, and the question “was this changed after the issuer made it?” has a real answer.

If a document could have been made by anyone with ordinary software, there may be no authoritative original to compare against. The file can still be checked for signs of change, but it cannot vouch for the facts it states. For those, the issuer is the source.

Either way, the generator is one input among several. It never replaces looking at the file’s history, and it never replaces confirming the content with the party who supposedly issued it.

Why HTPBE? does not publish what it knows

HTPBE? maintains knowledge of the fingerprints of the major PDF generation systems and uses it as one input among several when it assesses a file. We do not publish which systems, what they leave, or how it is weighed.

The reason is practical. A public list of what each generator leaves behind is a checklist for someone who wants a file to pass. A reviewer gains little from it, because the useful result is the verdict and the named checks, not the catalogue behind them. Someone preparing a doctored file gains a lot. The same reasoning is why we describe our checks by what they find, never by how they find it. They are listed in outcome terms on the how it works page.

We would rather say plainly that this knowledge exists and is kept private than pretend it is not there, or publish a field guide that works better for the wrong reader.

What you get back

HTPBE? returns one of three statuses:

• intact means no modification was detected.
• modified means the file shows evidence of change after it was created, and the result names the checks that found it. It states a fact about the file, not a reason and not a person.
• inconclusive means the file itself cannot answer the question. Some kinds of file come back inconclusive, never intact. That is a signal to confirm the document with its issuer, not a pass and not an accusation.

There is no numeric risk score. You receive a status, a modification_confidence and a list of named markers you can route on.

import os
import requests

API = "https://api.htpbe.tech/v1"
HEADERS = {"Authorization": f"Bearer {os.environ['HTPBE_API_KEY']}"}

submit = requests.post(
    f"{API}/analyze",
    headers={**HEADERS, "Content-Type": "application/json"},
    json={"url": "https://your-bucket.example.com/statements/applicant-42.pdf"},
)
check_id = submit.json()["id"]

result = requests.get(f"{API}/result/{check_id}", headers=HEADERS).json()

if result["status"] == "modified":
    route_to_manual_review(check_id, result["modification_markers"])
elif result["status"] == "inconclusive":
    request_issuer_confirmation(check_id)
else:
    continue_standard_checks(check_id)  # intact is not proof the content is true

What this approach cannot do

Looking at how a file was made is not the same as reading what it says.

• It cannot validate the data. A file can be well formed and still state things that are not true. Confirming content is a matter for the issuer.
• It does not judge whether a digital signature’s certificate is trusted. Pair it with a signature-validation library if you need that.
• It does not compare what the pages look like. Two files that look identical can differ in ways only the file’s own history shows.

Being clear about these limits is the point. A tool that claims to catch everything loses your trust first.

Where to read more

• How to check if a PDF has been edited for a practical walkthrough you can do yourself.
• Do PDF editing tools leave fingerprints? for the editing side of the same question.
• Bank statement fraud in lending and the fake bank statement detection workflow for how this plays out in practice.

Try it

Upload a PDF to HTPBE? and get a verdict typically within a few seconds, or call the API from your own intake flow. Plans and credit packs are on the pricing page.

Related FAQ: What is the difference between Creator and Producer in a PDF?

How producer and creator names are spread across documents people actually submit is shown, month by month, in the February and March 2026 integrity reports.