How does HTPBE? determine whether a PDF was modified?

HTPBE? looks for evidence inside the file itself that it was changed after the software that produced it finished writing it, and reports each piece of evidence by name. It does not read the text of the document and does not compare it with the issuer’s records. The question it answers is ‘does this file carry signs of later editing?’, not ‘is this document true?’.

The principle: a file keeps a record of its own life

Every PDF is written by some software at some moment, and later changes tend to leave evidence in the file. An edit, a re-save in another tool or a page swapped in from elsewhere can each leave traces of their own. HTPBE? looks for those traces and reports each one it finds by name.

The kinds of evidence a file can carry

The result page groups its checks by the kind of evidence they look for. The same names are returned field by field in the API.

• The file’s own history. Signs that the document was modified after it was created, or processed by an editing or conversion tool, or rebuilt as a new file.
• Dates that disagree. Dates recorded in the file that show it was changed after creation, or that cannot be real.
• Edits after signing. Content changed after a digital signature was applied, or a signature removed so the document looks unsigned.
• Pages from several sources. Pages that were produced separately and combined into one document.
• An origin that does not fit. A file that presents itself as the output of one application but does not look like it.
• Changes to what is on the page. Values that were covered over or replaced, and images that were edited and saved again.

The full list of public check names, with a plain-language description of each, is on the How it works page. Each name is a stable identifier that starts with HTPBE_ and never changes once published.

How the evidence becomes a verdict

Each check either found something or did not. The findings are then combined into one of three verdicts:

• Modified – at least one check found evidence of change after creation. The result lists which ones, and says how confident the finding is.
• Inconclusive – the file comes from a source that anyone can use to create a document from scratch, such as consumer software or a scan, so the file alone cannot support either conclusion. The reason is stated on the result.
• Intact – nothing was found, and the file comes from a source where that conclusion can be drawn.

Evidence of editing always takes priority: a file with findings is reported as Modified whatever software produced it. There is no numeric score and no percentage, only the verdict, the confidence on Modified results and the named findings. For how to act on each verdict, see How should I interpret PDF analysis results?

Why the findings matter more than the label

A verdict states a fact about the file, not who changed it or why. A single finding that matches an ordinary step in the document’s life, such as the sender re-saving the file, reads differently from several unrelated findings pointing at the same page. Read the names, then compare them with what you know about where the document came from. When it matters, ask the issuer for a fresh copy from their own system and check that one.

What the check does not do

• It does not read amounts, names or dates written in the document, so it cannot tell whether the content is true.
• It does not identify the person behind a document or confirm anything with the issuer.
• It cannot see a fake that was created from scratch and never edited. That file has no later history to find. See Can the PDF authenticity checker detect all types of modifications? for the full scope.
• It does not validate the certificate behind a digital signature.
• It cannot analyse a password-protected file.

Treat a clean result as the absence of detectable edits, and one input to a wider review.

Where to go next

To see this on a real file, upload a PDF to the checker, or read how PDF tamper detection works and how to check whether a PDF was edited. If you review documents in volume, the same verdicts and finding names come back from the HTPBE? API; per-check cost is on the pricing page.