Why does my PDF show as modified even though I didn’t edit it?
A Modified result means the file shows signs of having been changed after it was originally created. It says nothing about who did it or why. You can end up with that result without ever opening the file in an editor, because the file may have been re-saved, converted or processed by someone or something on its way to you.
Ordinary ways a file picks up a history
- Opened and saved again. Opening a PDF in a viewer or editor and pressing Save, even with no visible change, writes a new version of the file. Some viewers also save on their own when you close the document.
- Form filled in and saved. Typing into form fields, ticking boxes or adding a typed or drawn signature mark changes the file when you save it.
- Notes, highlights and comments. Annotating a document and saving it adds to the file.
- Merged, split or reordered. Combining several PDFs into one, pulling pages out of a larger file, or rearranging pages produces a new file built from older material.
- Signed or counter-signed. Applying a digital signature, or adding a second signer, changes the file after its content was produced.
- Passed through a service. Online converters, compressors, ‘print to PDF’ and PDF/A conversion create a new file from the old one, and so can document-management systems and email gateways that scan, stamp or shrink attachments.
- Exported again elsewhere. A report exported from one system, then opened and exported again from another, has been processed after it was first produced.
None of these needs bad intent. A landlord who fills in and re-saves a form, an assistant who merges three statements into one packet, or a bank portal that stamps every download can each produce a file that reads as Modified.
Find your case
- You filled in a form and saved it. Expect a result other than Intact. The sender should supply the blank original, or the issuer a fresh copy.
- You merged several statements into one packet. Expect Modified, often with a finding that pages come from several sources (
HTPBE_PAGES_FROM_MULTIPLE_SOURCES). Send the files separately instead. - You compressed the file to fit an email limit. Expect Modified, because the compressor writes a new file. Send the original, or a download link.
- Your bank portal or accounting package stamped every download. Check whether a second download of the same document gives the same result.
- You only opened it. Merely viewing does not change a file, but some viewers save automatically when closing, and a file synced through a cloud drive or mail gateway can be rewritten on the way.
An experiment that settles most cases
Download the document again from where it came from, without opening it in any editor, and check that copy. Then check your own copy. If the fresh download is Intact and yours is Modified, the history was added after the download, and the findings on your copy usually point to the step. If both are Modified, the document may have been handled before you ever received it, or the issuing system itself produces files that way; ask the issuer.
When this does not apply
Some findings are not explained by ordinary handling. Content changed after a digital signature was applied (HTPBE_POST_SIGNATURE_EDIT) and a signature removed after signing (HTPBE_SIGNATURE_REMOVED) do not come from opening and saving a file. If you see either and you did not sign or unsign the document yourself, ask who did.
What the verdict is, and what it is not
HTPBE? answers one question: was this file changed after it was originally created? It does not judge whether the content is true, and it does not guess at intent. A harmless re-save and a deliberate edit are both changes to the file, so both can show as Modified. The result tells you the file in front of you is not the pristine original; whether that matters depends on what you expected it to be. This is also why a Modified result is not an accusation: it is a fact about the file that you weigh against what you know about where it came from.
The reverse also holds. An Intact result does not make a document authentic, only unchanged since it was created. For how to read the three result states, see How should I interpret PDF analysis results?.
What to do next
- Ask for the original export. If the file came from a person or company, ask for the PDF exactly as the source system produced it, without opening, filling in, merging or re-saving it first. If it came from a bank, payroll provider, university or similar, ask them to send it straight from their system.
- Download it again from the source. A fresh download from the portal or account it originated from usually gives you the file before any later handling. Avoid opening it in a PDF editor before you check it, and avoid re-uploading it through a converter or compressor.
- Retrace the file’s journey. List every step between creation and now: who saved it, which apps opened it, whether it was emailed, scanned by a system, signed, merged or compressed. A step you can name often accounts for the result.
- Check a copy from the source. If you can obtain a copy directly from where it originated, check that too. If the two results differ, something likely happened to your copy along the way.
- Dispute it if you think it is wrong. If you believe the result is incorrect, open the check in your dashboard and use Report an Incorrect Result. We re-analyse the PDF and review it manually.
When the result matters
If a Modified file is part of a decision, such as a loan, a tenancy, a claim or a hire, treat the result as a reason to ask for the original, not as a verdict on the person. Ask for the source copy, give them a chance to explain how the file was handled, and decide on the evidence as a whole. To see how teams build this into a review process, read how to check if a PDF was edited and PDF tamper detection, or how to tell whether a PDF is real.
To run the same check on your own files or inside your own workflow, see the HTPBE? API and pricing.
Related questions
← Previous
What happens to my uploaded PDF file after analysis?
Next →
When HTPBE? flags a PDF as modified, can it tell a harmless re-save or compression apart from real content changes?
Related questions
Keep reading
3 answers
Reading Your Results
Not by itself. HTPBE? reports that a file was changed after creation and names each finding, but it does not label a change as harmless. A re-save, a compression pass and a content edit are all changes to the file; the named findings show what kind of change was seen.
No. The results page shows the analysis metadata and findings, not the document, and it offers no download of the original. Keep your own copy of the file.
Privacy, Data & Limits
Analysis results are kept so you can reopen them later, within the retention period set by the privacy policy (up to 3 years). The original file is handled as described in the privacy policy: web uploads may be retained in anonymised form, API files are not stored.