Can the PDF authenticity checker detect all types of modifications?

No. HTPBE? detects edits made to a PDF after it was created, but not a fake built from scratch. Some files get an INCONCLUSIVE verdict instead.

That is the honest scope of the tool. It answers one question about the file: was it changed after it was generated? It does not answer whether the numbers, names or claims inside the document are true. Below is what a result can and cannot tell you, with examples, so you know how much weight to put on each verdict.

What HTPBE? does detect

When someone takes a real PDF and changes it, the file usually carries evidence of that. HTPBE? looks for that evidence across its forensic checks and reports the ones that fired by name on the result page. In practice the edits it catches fall into these groups:

• Edited values in a real document. A bank statement balance, an invoice total, a salary figure or an account number changed in a desktop PDF editor, an online editor or a document-unlocking tool.
• Content covered or overlaid. A figure blanked out and replaced with new text on top of the original, including text laid over a scanned page.
• Changes after signing. Content altered after a digital signature was applied, or a signature removed so the document looks unsigned.
• Timeline that does not add up. Creation and modification dates that disagree with each other or with the claimed origin, or timestamps that cannot be real.
• Assembled documents. Pages combined from different sources, a page swapped in or out, or a file rebuilt as a new document to hide its history.
• Edited images. Embedded pictures that show signs of being altered and re-saved, and documents flattened to an image to discard their editing history.
• Generator that does not fit the document. A file that claims to come from one application but shows traces of another, or that has passed through a known editing or conversion service.

A MODIFIED verdict means the evidence shows the file was changed after it was created. It states the fact of an edit. It does not state who edited it or why: a re-saved export and a forged salary slip can both be MODIFIED, which is why the named findings matter more than the label alone.

What HTPBE? cannot detect

These cases are outside what file analysis can establish. In each one, the right response is a different kind of check, not a second run of the same one.

• A document created from scratch with false content. If someone types a fake pay stub in a word processor and exports it to PDF, the file was never edited after creation. There is nothing to detect. See Can someone create a fake document from scratch? for how to check these.
• False but original content. A genuine, unaltered PDF from a real system that records wrong information. The file is intact; the data is not.
• Changes made before the PDF existed. Anything altered in the source document or spreadsheet before it was exported to PDF is invisible to a file-level check.
• Identity. HTPBE? does not confirm who a person is and does not compare a document with the issuer’s own records.
• Encrypted PDFs. A password-protected file cannot be analysed. Remove the protection at the source and submit the unencrypted copy.

No file-level check is a guarantee against every manipulation. Treat a clean result as the absence of detectable edits, not as proof of authenticity.

What each verdict means in practice

• INTACT – no sign that the file was changed after it was created, and the file comes from a source where that conclusion can be drawn. It means ‘not edited’, not ‘true’.
• MODIFIED – the file was changed after creation. Read the named findings, then compare them with what you know about the document’s history. Opening and re-saving a file is a legitimate reason; a changed figure in a financial statement usually is not.
• INCONCLUSIVE – the file does not carry enough evidence either way. This is a statement about the limits of the analysis, not an accusation, and not a pass.

HTPBE? never returns INTACT for a screenshot, a scan or a printed-and-rescanned copy, however clean it looks. A picture of a document has lost the file-level evidence the check depends on, and anyone can produce one from any original. The same applies to files exported from everyday software that anyone can run: such a file can be genuine or fabricated, and the file cannot say which. For those, the verdict is INCONCLUSIVE and the work moves to the source. See Why does my official document show INCONCLUSIVE?

Examples

• Bank statement sent by a loan applicant. The file came out of a banking system, and a transaction amount was changed afterwards in an editor. Typical result: MODIFIED, with the findings naming the type of change. A statement typed from scratch in a word processor gets INCONCLUSIVE, so you ask the applicant for a copy downloaded straight from their bank.
• Employment letter with an altered salary. A genuine letter is edited to raise the figure. Typical result: MODIFIED. An invented letter exported from an office suite: INCONCLUSIVE, and the next step is to contact the employer.
• Signed contract. A line is changed after signing. Typical result: MODIFIED, because the content differs from what was signed.
• Phone photo of a certificate. It is a picture, not the issuer’s file. Typical result: never INTACT. Ask for the original digital file.
• Invoice that was opened and re-saved by an accountant. It may show as MODIFIED even though nothing was falsified. That is why the findings and the document’s known history belong together. See Why does my PDF show as modified when I did not edit it?

When the check cannot be completed in full

Some checks cannot be completed in full. If a modification was established anyway, the result is Modified with its findings. If not, the result is Inconclusive with the reason analysis_incomplete, and an empty list of findings in that case is not evidence that the document is clean. Treat the document as unverified and ask the issuer for a fresh copy. Password-protected files cannot be analysed at all and are rejected as unreadable.

Scope at a glance

• Covered: a file that was changed after it was created, in any of the groups above.
• Not covered by design: whether the content is true, who made the document, and whether the issuer really issued it.
• Covered only by saying so: scans, screenshots and files from software anyone can run. They are not certified as Intact.

When this does not apply: if you hold the issuer’s own original download and have not touched it, the question ‘could something have been missed?’ is much narrower, and an Intact result on that file is as strong as this kind of check gets. The weaker case is a copy that has passed through several hands.

How to use the result well

1. Read the findings, not just the label. The named checks say what kind of change was found.
2. Match the verdict to your risk. For a low-value document, MODIFIED may be enough to ask for a new copy. For a lending, tenancy or insurance decision, add a source check as well.
3. Go to the source on INCONCLUSIVE. Re-download from the issuer’s portal, call the employer, or ask for a signed original.
4. Keep the result with the case. The result page can be shared, so a reviewer or auditor sees the same evidence you did.

Run it on your own documents

To see the verdicts on real files, upload a PDF to the checker, or read how PDF tamper detection works and how to check whether a PDF was edited. For document types that arrive in volume, such as bank statements in lending and onboarding, the same check runs through the API. See pricing for per-check cost, or use a test key to try the integration first.

Related questions

• Can a PDF be modified without detection? covers how much to rely on a result.
• How accurate is PDF modification detection?
• How does HTPBE? determine whether a PDF was modified?

Price per check is on the pricing page; the same verdicts come back from the API.