How to Tell If a PDF Was Modified
HTPBE.tech is an online tool that tells you whether a PDF has been edited (yes/no) — automatically, in seconds, without needing to know how PDF forensics works.
Or learn the manual method below: what to look for and how to interpret what you find.
What to Look For in a PDF
Every PDF carries hidden evidence of its history. Here is what to look for.
Check the modification date
Open the PDF properties (in Adobe Acrobat: File → Properties → Description; in macOS Preview: Tools → Show Inspector). If the modification date is significantly later than the creation date, the document was changed after it was made.
Compare the Creator and Producer fields
The Creator field shows the original application (e.g. "Microsoft Word"). The Producer shows what last processed the file (e.g. "Adobe Acrobat"). A mismatch — especially when you wouldn't expect it — suggests the file was re-processed or edited.
Look for incremental updates in the file structure
PDFs can be edited by appending new data without rewriting the original. This technique, called an incremental update, leaves multiple cross-reference tables in the file. Manual detection requires a hex editor — or you can use HTPBE to detect it automatically.
Verify any digital signatures
If a PDF has a digital signature, any modification after signing will invalidate it. In Adobe Acrobat, a red warning icon on the signature panel indicates post-signature modification. A missing signature on a document that should have one is also suspicious.
The Easy Way: Use HTPBE
All checks run automatically in seconds — no technical knowledge required.
Upload the PDF to HTPBE
Instead of checking manually, drag your PDF onto the tool at htpbe.tech. Free, no account needed.
All checks run automatically
HTPBE checks timestamps, creator/producer fields, revision layers, digital signatures, and more — simultaneously.
Read the report
The result page shows a yes/no verdict, risk score, and a plain-language explanation of every finding.
Frequently Asked Questions
What metadata reveals if a PDF was modified?
The most important fields are: CreationDate (when the document was originally created), ModDate (when it was last modified), Creator (the application that created the original document), and Producer (the application that last produced/processed the PDF). Discrepancies between these fields are a primary sign of modification.
Can I check PDF modification date without any tool?
Yes — in Adobe Acrobat: File → Properties → Description tab. In macOS Preview: Tools → Show Inspector → General. In any PDF reader that shows document properties. However, this only shows timestamps. It won't reveal structural changes like incremental updates or removed digital signatures.
What is an incremental update in a PDF?
An incremental update is a technique where edits are appended to the end of a PDF file rather than rewriting it. The original content remains in the file, with new data layered on top. This is how most PDF editors work and it leaves a detectable structural trace that appears as multiple cross-reference tables in the file.
What if the creation and modification dates are identical?
Identical dates usually mean the file was never edited — but they can also mean the metadata was deliberately altered to hide modifications. HTPBE's structural analysis examines the file beyond timestamps, so it can often detect editing even when metadata has been spoofed.