How does the PDF authenticity checker work?

Our PDF modification checker uses multi-layer forensic analysis to detect whether a PDF document was changed after it was originally created. The system analyzes PDF metadata including creation dates, modification timestamps, creator and producer information, and PDF version details.

We also examine the internal file structure at the byte level to identify evidence of post-creation modifications, detect digital signatures and analyze their integrity, and scan for embedded malicious code or suspicious scripts.

You see one of three outcomes: Intact (no modification detected), Modified (modification detected), or Cannot Verify (the PDF was created with consumer software such as Microsoft Word or a print-to-PDF driver — integrity analysis does not apply to documents anyone can create from scratch).