ReportLab appears on both legitimate first-generation output and downstream re-save flows — context (the other tool on the same document) is what flips the signal.
Back to all statisticsForensic verdictBased on this tool’s share of the HTPBE? corpus.
Corpus profile
ReportLab is a Python PDF generation toolkit used both for legitimate server-side document creation and for scripting-driven PDF assembly.
ReportLab is often the original Creator and Producer on Python-stack output. The contextual signal arises only when its presence breaks the expected creator/producer pairing on a document whose origin should not have routed through Python.
Role in the workflow
Every PDF carries a Creator (the application that produced the original document) and a Producer (the engine that wrote the PDF). The same tool can appear in either slot, with very different modification profiles.
Name fingerprints
Different version strings and spellings observed for ReportLab in the wild. All are merged into the same canonical profile.
Why variants matter
The same tool publishes itself under 3 different metadata strings – version bumps, locale tags, build IDs. We canonicalize them so the corpus reflects one identity, not noise.
Distributions
The PDF versions ReportLab writes when acting as Producer, and the other tools that appear in the same documents.
Most output is PDF 1.4 (98% of files where ReportLab is the Producer).
TamperCheck.ai sits upstream in 86% of cases — read this row as “what kinds of documents end up routed through ReportLab.”
Related profiles
Other tools that frequently share metadata with ReportLab in the same documents. Each card links to its own forensic profile.
Long tail
Smaller cuts of the ReportLab corpus – useful context, but treat each row as a single data point rather than a strong signal.
Of files carry at least one digital signature
Of files have attachments inside
Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.