logo
Forensic check

HTPBE_POST_SIGNATURE_EDIT

HTPBE_POST_SIGNATURE_EDIT appears on 1.6% of modified results in our corpus. A marker is evidence about the file, not a judgement about the person who sent it.

Back to all checks
Marker profile

Digital Signatures

Content changed after the document was digitally signed.

Share of modified results
1.6%
Frequency rank
#18
Among the 56 markers seen in modified results
Certain confidence
100.0%
Of results with this marker rated certain rather than high
Fires alone
35.9%
Results where it is the only marker found

Marker profile

What HTPBE_POST_SIGNATURE_EDIT tells you

HTPBE_POST_SIGNATURE_EDIT is one of the named findings returned in modification_markers when a PDF is reported as modified. It belongs to the Digital Signatures group of checks. These checks look at whether a digital signature is still in place and whether anything changed after it was applied.

On 35.9% of the modified results that carry HTPBE_POST_SIGNATURE_EDIT it is the only marker. A result with this marker carries 2.1 markers on average. It is most often found together with HTPBE_TOOL_VS_STRUCTURE_MISMATCH, on 40.6% of these results.

Example API response

How it appears in a result

When a PDF is reported as modified, HTPBE_POST_SIGNATURE_EDIT is listed in modification_markers next to the verdict and its confidence. Each marker is a named, actionable finding – not a score.

GET /api/v1/result/{id}
{
  "id": "9f3a2c1d-8b47-4e6f-a012-3d5e7f890123",
  "status": "modified",
  "modification_confidence": "high",
  "modification_markers": [
    "HTPBE_POST_SIGNATURE_EDIT"
  ],
  "creator": "Adobe Acrobat Pro DC",
  "has_incremental_updates": true,
  "page_count": 3
}

Full schema in the API reference →

Distributions

What ships alongside HTPBE_POST_SIGNATURE_EDIT

The tools, formats and document traits that appear on the modified results carrying this marker. Shares are of those results.

Common Producers

TCPDF writes 75.9% of these results – and 87.2% of all modified results naming it carry this marker.

TCPDF87.2% of its modified75.9%
Acrobat Sign16.3% of its modified8.2%
iText0.5% of its modified2.9%
PDFKit.NET71.4% of its modified2.9%

Common Creators

Joomla is the Creator on 74.7% of these results.

Joomla100.0% of its modified74.7%
Microsoft Word1.4% of its modified9.4%

Often found together with

HTPBE_TOOL_VS_STRUCTURE_MISMATCH sits next to HTPBE_POST_SIGNATURE_EDIT more often than any other marker.

Document origin

Institutional84.1%
Consumer software13.5%
Unknown2.4%

Creator → Producer pairs

Joomla → TCPDF74.7%
Microsoft Word → Acrobat Sign8.2%

Detected origin software

Microsoft Word9.4%
macOS / iOS (Quartz)2.4%

Confidence of the verdict

Certain98.2%

When these results were checked

March 20261.8%
April 202684.7%
June 20262.4%
July 20262.9%
August 20261.8%
September 20263.5%
October 20262.4%
November 20260.6%

Document length

1 page4.7%
2–5 pages80.0%
6–20 pages12.4%
21–100 pages1.2%

File size

Under 100 KB77.1%
100 KB – 1 MB21.2%
1 – 5 MB1.8%

PDF versions

PDF 1.787.6%
PDF 1.44.1%
PDF 1.33.5%
PDF 1.61.8%

Year the document says it was created

20168.2%
20242.4%
20252.4%
202682.4%

Long tail

Notable observations

Smaller cuts of the results carrying HTPBE_POST_SIGNATURE_EDIT – useful context, but treat each row as a single data point rather than a strong signal.

Digitally signed
98.2%

Of files carry at least one digital signature

Saved revisions
18.2%

Of files contain earlier saved revisions

Embedded JavaScript
0%

Of files contain JavaScript code

Embedded files
1.8%

Of files have attachments inside

Avg pages per document
6.0
Markers per result
2.1

Average number of markers on these results

Related checks

Other Digital Signatures checks

Checks from the same group. Each card links to its own reference page.

HTPBE_SIGNATURE_REMOVEDEvidence that a digital signature was stripped after signing
Share of modified0.2%

FAQ

HTPBE_POST_SIGNATURE_EDIT: common questions

What does HTPBE_POST_SIGNATURE_EDIT mean?

HTPBE_POST_SIGNATURE_EDIT is a named finding in an HTPBE? result: content changed after the document was digitally signed. It is returned in the modification_markers list of a modified result and belongs to the Digital Signatures group of checks.

Does HTPBE_POST_SIGNATURE_EDIT mean the document is fake?

No. A marker is evidence about the file, not a judgement about the person who sent it. It records that the file shows this pattern; it does not say why, and it does not assess what the document states. Read it together with the verdict and any other markers on the same result.

What should I do when a result contains HTPBE_POST_SIGNATURE_EDIT?

Ask the sender for the original file straight from the issuing system, or request a fresh copy from the issuer. Check whether the document went through a later step such as re-saving, merging or converting, and verify it with the issuer before relying on it for a decision.

How common is HTPBE_POST_SIGNATURE_EDIT?

HTPBE_POST_SIGNATURE_EDIT appears on 1.6% of the modified results in the HTPBE? corpus. The corpus consists of PDFs people chose to submit for checking, so it skews towards documents someone had a reason to doubt and is not a sample of all PDFs.

Where do I see HTPBE_POST_SIGNATURE_EDIT?

In the modification_markers list of the result returned by the HTPBE? API, and on the result page of a modified document. Other checks in the Digital Signatures group are listed below on this page; all 63 checks are listed on the how-it-works page.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →