logologo
  • How it works
  • Why It Matters
  • Statistics
  • Pricing
  • FAQ
  • API
logologo
  • How it works
  • Why It Matters
  • Statistics
  • Pricing
  • FAQ
  • API
HTPBE?

Structural PDF tamper detection API. Catches edits your KYC stack misses.

Product

  • How It Works
  • Use Cases
  • Metadata Viewer
  • Pricing

Developers

  • API Reference
  • GitHub/docs
  • Changelogv2.44.3

Resources

  • About
  • Blog
  • Comparisons
  • Legal & Imprint

© 2024–2026 TMI Iurii Rogulia · VAT ID: FI29845875 · Made in Finland 🇫🇮

Status

Algorithm v2.44.3

Tool profile

GPL Ghostscript

GPL Ghostscript reads as a downstream re-saver — it surfaces disproportionately on documents whose original Creator was a different, often institutional, application.

Back to all statistics
Forensic verdict

Anomaly profile

Based on this tool’s share of the HTPBE? corpus.

Modification rate
46%-3pp below baseline
Corpus baseline: 49%
Corpus share
0.21%
Share of all analyzed appearances
Modification rate
46%
-3pp below baseline
Role split
0%C/100%P
Creator vs Producer share of appearances

Corpus profile

How GPL Ghostscript shows up in HTPBE? corpus

Ghostscript is an open-source PostScript/PDF interpreter used both as an internal print-pipeline component (legitimate) and as a re-distillation step that flattens / rebuilds an existing PDF.

Ghostscript as the latest Producer on a document whose Creator was institutional typically indicates a re-distillation pass — that producer/creator mismatch is the contextual signal.

The signal
Ghostscript as the latest Producer on a document whose Creator was institutional typically indicates a re-distillation pass — that producer/creator mismatch is the contextual signal.

Role in the workflow

How GPL Ghostscript shows up in metadata

Every PDF carries a Creator (the application that produced the original document) and a Producer (the engine that wrote the PDF). The same tool can appear in either slot, with very different modification profiles.

CAs Creator · 0%
As Producer · 100%P
CAs Creator
  • Share of appearances
    0%
  • Modification rate
    0%
PAs Producer
  • Share of appearances
    100%
  • Modification rate
    46%
  • Avg file size
    171 KB

How to read this

The Creator slot typically reflects where a document started life. The Producer slot reflects whatever wrote the bytes — and is the field that gets overwritten when a PDF is opened, edited, and saved by a downstream tool.

A higher modification rate as Producer than as Creator usually means the tool is acting as a re-saver on documents that originated elsewhere. A higher rate as Creator points to fragile workflows around the original authoring app.

Name fingerprints

Also goes by

Different version strings and spellings observed for GPL Ghostscript in the wild. All are merged into the same canonical profile.

GPL Ghostscript 10.00.014.0%
GPL Ghostscript 10.05.114.0%
GPL Ghostscript 9.0610.0%
GPL Ghostscript 10.06.08.0%
GPL Ghostscript 10.07.08.0%
GPL Ghostscript 10.03.18.0%
GPL Ghostscript 8.156.0%
GPL Ghostscript 9.54.06.0%
GPL Ghostscript GIT PRERELEASE 10.05.04.0%
GPL Ghostscript 9.55.04.0%
GPL Ghostscript 10.02.04.0%
GPL Ghostscript 9.254.0%
GPL Ghostscript 8.702.0%
dvips + GPL Ghostscript 8.702.0%
GPL Ghostscript 9.53.32.0%
GPL Ghostscript 9.232.0%
GPL Ghostscript 8.712.0%

Why variants matter

The same tool publishes itself under 17 different metadata strings — version bumps, locale tags, build IDs. We canonicalize them so the corpus reflects one identity, not noise.

Most common
GPL Ghostscript 10.00.0
14.0% of appearances
Variant spread
17 distinct strings
Long-tail share: 86.0%
Observed range
12.12.2016 → 12.08.2026

Distributions

What ships alongside GPL Ghostscript

The PDF versions GPL Ghostscript writes when acting as Producer, and the other tools that appear in the same documents.

PDF versions written

Most output is PDF 1.7 (62% of files where GPL Ghostscript is the Producer).

PDF 1.761.5%
PDF 1.434.6%
PDF 1.63.8%

Common Creators when GPL Ghostscript is the Producer

PScript5 sits upstream in 26% of cases — read this row as “what kinds of documents end up routed through GPL Ghostscript.”

PScript525.6%
UnknownApplication23.1%
PDFCreator10.3%
Groupe LDLC7.7%
GNU Enscript7.7%
PDF245.1%
wkhtmltopdf5.1%
Microsoft Word5.1%
Safari5.1%
CURRYS5.1%

Related profiles

Tools you’ll see next to GPL Ghostscript

Other tools that frequently share metadata with GPL Ghostscript in the same documents. Each card links to its own forensic profile.

C20% co-occurrence
PScript5
Corpus share1.4%
Mod rate51%
C18% co-occurrence
UnknownApplication
Corpus share0.05%
Mod rate58%
C8% co-occurrence
PDFCreator
Corpus share0.07%
Mod rate100%
C6% co-occurrence
Groupe LDLC
Corpus share0.01%
Mod rate33%
C6% co-occurrence
GNU Enscript
Corpus share0.01%
Mod rate100%

Long tail

Notable observations

Smaller cuts of the GPL Ghostscript corpus — useful context, but treat each row as a single data point rather than a strong signal.

Avg pages per document
2.5
Oldest observed
12.12.2016 — over 9 years ago

Secure your workflow

Create your account — check PDFs on the web or with an API key, both ready on signup.
From $15/mo. No sales call. Cancel any time.

Start Free — Close the Structural Fraud GapSee Pricing
Read API Docs →