logo
Free PDF Check

PDF Tamper Detection – Find Out If Your Document Was Altered

Built for fraud ops at lending, insurance & compliance teams

HTPBE? is a PDF tampering detection tool that identifies whether a document was altered after creation – check it in the browser, with an API for automated workflows. Used to detect altered invoices, forged contracts, and tampered certificates. Receiving a PDF and have no original to compare against? See the no-original-file workflow.

~3 sec
per document
63 checks
forensic layers
1,500+
docs / month on Growth
Plans
subscriptions or one-off packs – see pricing

The problem

Modern document fraud is invisible to visual review

A growing class of document fraud opens a genuine PDF, edits a balance, a date, or a beneficiary, and re-saves it. Visually nothing changes – the document passes pixel-level review, layout review, and KYC.

Structural PDF analysis reads the layers rendering engines never expose: revision history, object structure, signature coverage maps. That is where edits leave fingerprints they cannot wipe.

Common tampering patterns

  • Modified balances or totals after export
  • Swapped IBAN or beneficiary on invoices
  • Post-signature edits on contracts
  • Backdated issue and modification dates
  • Fabricated documents from consumer PDF tools

What this looks like

What PDF Tampering Detection Looks For

Three real fraud mechanics we catch at the structural PDF layer.

01

Timestamp anomalies – the most common tampering signal

A PDF carries internal creation and modification dates. A modification date that differs from the declared creation date is one of the most common signs that a file was changed after it was produced.

02

Fingerprints of a known PDF editing tool

Tools built for editing existing PDFs leave their own fingerprints in the file. HTPBE? recognises hundreds of PDF generators and editors, and the fingerprints of a known editing tool are a strong indicator the file was modified after creation.

03

Edits saved after creation

Edits saved into a PDF after it was created leave evidence that is invisible in a PDF viewer but detectable through structural analysis.

04

Removed or invalidated digital signature

A digital signature cryptographically locks a document’s contents. If a signed document is later modified, the signature becomes invalid. If the signature was removed entirely after tampering, that absence is itself evidence of forgery.

05

Lookalikes judged on the file

However closely it copies the issuer’s layout, a bank statement, payslip or tax form comes back MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it. INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.

06

Pages from different sources

When a PDF is edited in multiple sessions – or pages are assembled from different source files – the file carries traces of that assembly. They are invisible to a reader, and HTPBE? reports pages assembled from independently rendered sources as a named marker.

63 layers
Forensic checks per document
~3 sec
Median analysis time, end to end

The detection gap

KYC platforms check the document. HTPBE? checks the file.

Two different checks – both matter.

KYC & identity platforms

Plaid · Persona · Alloy · Jumio

  • Is this a real bank statement template?
  • Does the account number match the identity?
  • Is the document format consistent with the issuing bank?

Detects fake documents. Does not detect edited real documents.

HTPBE? tamper detection API

Structural PDF integrity

  • Was this specific PDF file modified after it was generated?
  • Does the file carry evidence of editing after export?
  • Were digital signatures valid at the time of signing?

Catches edits invisible to visual review and template checks.

Results in under 3 seconds30 to 1,500+ documents/month

What HTPBE? checks

Detection capabilities

Deterministic structural signals. No probabilistic scores, no model training.

Stated origin contradicted

The file’s structure contradicts the origin it states – a common sign of editing after export.

Post-creation edits

Detects documents that were changed and saved again after they were first produced, and reports them with a named marker.

Pages from multiple sources

Documents assembled from pages of different files – a page swapped in from another statement, a forged page spliced into a genuine pack.

Date inconsistencies

Creation and modification dates that contradict each other, or dates that could not be real. Either is a sign the file changed after it was issued.

Digital signature validation

When a document is digitally signed, HTPBE? checks whether it changed after signing or had its signature removed. Either finding returns a certain-confidence verdict.

Replaced or overlaid text

Detects text replaced or added on a page after the document was produced – without relying on how the page looks on screen.

Share with engineering

Wire this into your intake pipeline in under a day

Two API calls – one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.

Full API reference for engineering

Pricing

Self-serve plans, no sales call

All plans include the same forensic checks. Pick the quota that matches your monthly document volume.

manual

Starter

30 credits/mo

Manual spot-checks and integration testing

most common

Growth

350 credits/mo

Active document processing pipelines

high volume

Pro

1,500 credits/mo

High-volume automation and API integrations

Enterprise (unlimited, on-premise available) — see full pricing

Secure your workflowView API docs

API key on signup. Free test environment on every plan. No card required.

Customer Stories

Teams that stopped document fraud

Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.

Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.

Sarah M.

AP Manager

United States

We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.

Lars V.

Risk Analyst, Online Lending

Netherlands

Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.

Priya K.

HR Operations Lead

India

Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.

Julien R.

Fraud Analyst, Fintech

France

Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.

Marta S.

Compliance Coordinator

Spain

One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.

Tariq A.

Finance Manager

United Arab Emirates

FAQ

Frequently asked questions

What is PDF tamper detection?

PDF tamper detection – also called PDF tampering detection – is the process of analyzing a PDF document’s internal data to determine whether it was modified after its original creation. It examines metadata timestamps, file structure revision history, digital signature integrity, and application fingerprints to identify signs of tampering.

Can I just check if this PDF was edited?

Yes. Upload the PDF using the checker above and the tool returns INTACT or MODIFIED in under 3 seconds, with a plain-language list of every finding. No software to install – just the verdict on whether the document was edited after it was created.

How do I know if a PDF has been tampered with?

Upload it to HTPBE?. The tool analyzes the PDF’s internal metadata, file structure, revision history, and digital signatures – all in under 3 seconds. If the file was modified after creation, the analysis returns a ‘modified’ status with a plain-language list of specific findings.

Can PDF tamper detection catch all types of tampering?

No automated tool catches everything. HTPBE? reliably detects the most common tampering methods – metadata editing, edits saved after creation, signature removal.

Is PDF tamper detection free?

Your first 5 credits are free when you sign up – no card required. After that, pay-per-check credits and the REST API for automated tamper detection workflows are both available – see pricing.

How do teams use PDF tamper detection in production?

The most common integration is a pre-screen step at document intake. When an applicant, vendor, or claimant uploads a PDF, the API returns a structured verdict before the document reaches a human reviewer. Lenders use it on bank statements and payslips. AP teams use it on vendor invoices. Claims ops use it on repair invoices and medical bills. Every verdict is deterministic with named structural markers suitable for an audit trail.

Does tamper detection work alongside existing KYC, OCR, or AP platforms?

Yes – it is designed to be additive. Identity-proofing platforms (Persona, Onfido, Alloy) check the person. OCR platforms extract data. AP automation routes invoices. None of them analyze the structural integrity of the PDF itself. HTPBE? adds that layer at the document level without replacing any existing workflow.

How can I tell if a PDF has been edited?

Upload the file to the checker above. HTPBE? reads the document’s internal metadata, file structure, revision layers, and digital signatures and returns INTACT or MODIFIED in under 3 seconds, with a plain-language list of every finding. You don’t need the original file to compare against – the analysis is one-sided, using only evidence inside the PDF itself.

How do I check if a PDF was edited for free?

Sign up and your first 5 credits are free – no card required. Drop any PDF up to 10 MB onto it and you get a clear verdict on whether the file was edited after it was created. We never read your document content, only the file structure; web uploads may be kept, without linkage to your account, to improve detection.

Can I check if a PDF was edited online?

Yes. HTPBE? runs entirely in the browser flow – there is no software to install. Upload the PDF here, wait a few seconds, and read whether the document was modified after creation, along with the specific signals that fired.

Can you tell if a PDF has been edited without the original?

Yes. HTPBE? does not compare your file to a reference copy. It examines internal evidence – metadata timestamps, structural revision layers, application fingerprints, and signature state – that lives inside the single PDF you upload. That is why it works even when you only have the file someone sent you.

How do I know if a PDF was modified after it was created?

A PDF carries internal creation and modification timestamps and a record of which software last processed it. When those signals disagree with each other – or with the document’s claimed source – the file was changed after it was first produced. Upload it above and HTPBE? surfaces exactly which signals diverged.

How do I check when a PDF was last modified?

Every PDF stores a modification date in its metadata. The free metadata viewer and the tamper checker both read it for you. Be careful, though: the modification date is itself easy to rewrite, so a clean date alone does not prove a file is untouched – that is why HTPBE? cross-checks it against structural evidence rather than trusting the timestamp on its own.

Can a PDF be edited without leaving a trace?

Most everyday edits – made with consumer PDF editors, spreadsheet round-trips, or online tools – leave structural traces that HTPBE? detects. A determined forger who rebuilds the entire file from scratch can sometimes produce a document with no editing trace, but that requires real technical effort; the overwhelming majority of real-world tampering uses the common methods this checker is built to catch.

How do I tell if a PDF was changed after it was signed?

A digital signature cryptographically locks the document’s contents at the moment of signing. If the file is altered afterwards, the signature breaks – and if it was stripped out entirely after tampering, that absence is itself evidence. HTPBE? checks both: modifications after signing and signature removal are among the highest-confidence verdicts it returns.

Does a PDF keep an edit history?

Not a human-readable one, but edits saved into a PDF after it was created usually leave evidence a normal PDF viewer never shows. HTPBE? detects that evidence through structural analysis and reports it as a named marker.

How can I tell if someone edited a PDF I received?

Upload the file you received to the checker above – you don’t need anything from the sender. HTPBE? returns whether the document was modified after its original creation and lists the named structural markers behind the verdict, so you have something concrete to act on.

How do I check if a scanned PDF was edited?

Scanned and print-to-PDF documents are analyzed at the structural layer like any other file. HTPBE? flags signs that a scan was re-processed through an editing tool after it was produced. A scan never returns INTACT – INCONCLUSIVE is the ceiling, because scanning replaces the original digital document with a new image-based file. What the check looks for is evidence that the file was edited after it was scanned.

How do I tell if a PDF was edited in Photoshop or Illustrator?

A PDF comes back MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it – Photoshop and Illustrator included. When nothing in the file settles the question either way, it comes back INCONCLUSIVE for manual review. Upload the file above to see the result.

How do I check if a bank statement PDF was edited?

Bank statements are the most-faked document type, so this is one of the most common uses of the checker. Upload the statement and HTPBE? reports whether it was re-saved through an editing tool or otherwise changed after issuance. A statement comes back MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it, however closely it copies the bank’s layout.

How do I tell if a PDF invoice was edited?

Upload the invoice above. HTPBE? checks whether a single field – an amount, a date, or a payment line – was altered after the invoice was first generated, the pattern behind most invoice and business-email-compromise fraud. The verdict comes with named markers suitable for an audit trail.

What does it mean when a PDF says it was modified?

A MODIFIED verdict means HTPBE? found structural evidence that the file was changed after its original creation – for example a post-signing edit, a removed signature, disagreeing internal dates, or an editing-tool fingerprint. It does not by itself say the document is fraudulent; it tells you the file is not the untouched original, which is your signal to review it more closely.

Can I check if a PDF was edited on a Mac, iPhone, or Android?

Yes. The checker is browser-based and works on any device – desktop or mobile. Open this page, upload the PDF, and read the verdict. There is nothing to download.

Can I detect edited PDFs automatically, in bulk?

Yes. The same analysis behind this checker is available as a REST API: send a PDF URL, get back a structured verdict with named modification markers. Teams wire it into document-intake pipelines so every uploaded file is checked before a human sees it. API access is self-serve – see pricing.

Will the result tell me which part of the PDF was edited?

HTPBE? tells you that the file was modified and which structural markers fired – for instance a post-signing edit or an editing-tool fingerprint. It does not highlight the exact pixel or word that changed; structural forensics establishes that tampering occurred, which is what a reviewer needs before deciding to reject or escalate a document.

Can I trust the modification date shown in a PDF?

Not on its own. The modification date is part of the metadata, and metadata is one of the easiest things to rewrite – a clean date proves nothing by itself. HTPBE? treats the date as one signal among many and cross-checks it against structural evidence that is far harder to forge.

Is checking whether a PDF was edited really free?

Yes. Your first 5 credits are free when you sign up – no card required. We never read the content of your document; analysis is strictly structural. Files uploaded through the web tool are stored in encrypted EU storage and may be retained without linkage to your account to improve our detection, while files submitted through the API are never stored. After your free credits, pay-per-check credits and the automated API are both available – see pricing.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →