Preview reads as a downstream re-saver — it surfaces disproportionately on documents whose original Creator was a different, often institutional, application.
Back to all statisticsForensic verdictBased on 145 appearances across the HTPBE? corpus.
Corpus profile
macOS Preview is the system PDF viewer / lightweight editor. Its presence as Producer means the document was opened and saved by Preview at least once.
Preview-as-Producer is extremely common on Mac and is legitimate for tasks like adding a signature stamp. Contextual signal: producer/creator mismatch when Preview is the latest Producer on a document whose Creator was an institutional source — the document was opened and saved through Preview after creation.
Role in the workflow
Every PDF carries a Creator (the application that produced the original document) and a Producer (the engine that wrote the PDF). The same tool can appear in either slot, with very different modification profiles.
Name fingerprints
Different version strings and spellings observed for Preview in the wild. All are merged into the same canonical profile.
Why variants matter
The same tool publishes itself under 2 different metadata strings — version bumps, locale tags, build IDs. We canonicalize them so the corpus reflects one identity, not noise.
Distributions
The PDF versions Preview writes when acting as Producer, and the other tools that appear in the same documents.
Related profiles
Other tools that frequently share metadata with Preview in the same documents. Each card links to its own forensic profile.
Long tail
Smaller cuts of the Preview corpus — useful context, but treat each row as a single data point rather than a strong signal.
Create your account — API key on signup, free test environment on every plan.
From $15/mo. No sales call. Cancel any time.