{"schemaVersion":"1.0","datasetId":"htpbe-pdf-statistics","name":"PDF Tampering & Modification Statistics","description":"Anonymized aggregate statistics from PDFs analyzed in production by HTPBE. Aggregate rates and shares only — no per-document, personal, or absolute-count data.","source":"https://htpbe.tech/statistics","license":"https://creativecommons.org/licenses/by/4.0/","engine":{"currentVersion":"2.38.2","reprocessed":false},"generatedAt":"2026-07-22T20:22:10.797Z","updateFrequency":"daily","temporalCoverage":"2000-01-01/2026-08-19","analysisPeriod":{"firstAnalysis":"2024-10-03","lastAnalysis":"2026-07-22"},"sampleMagnitude":"tens of thousands","methodologyCaveat":"Self-selected sample, not a population base rate: people submit a PDF to a structural tamper-check precisely because they already suspect it. Read as \"of the files brought to a tamper-check, this share was structurally modified\", never as a base rate for all PDFs. Rates cover only checks that reached a confident verdict; inconclusive consumer-grade origins are excluded.","modificationDefinition":"A file is counted as modified when structural evidence shows a post-creation write pass — an incremental update, a re-export, or a re-render — regardless of whether the edit changed visible content. Files whose origin cannot be confidently classified (consumer print-to-PDF, scans, online editors) are reported as inconclusive and excluded from the headline modification rate. No content-level or issuer-database verification is performed; this is a structural-layer measurement only.","precisionNote":"All percentages are rounded to one decimal place. A value of 0.0 therefore means below 0.05%, not necessarily an exact zero. Each check reflects the algorithm version that was live at the moment it was analyzed; results are not reprocessed with the current engine, so engine.currentVersion is the latest engine, not a version every row was scored with.","headlineRatesPercent":{"modifiedShareOfConclusiveAnalyses":47.9,"digitallySigned":4.7,"embeddedJavascript":0.6,"signedButModifiedAfterSigning":19.8},"structuralAnomaliesPercent":{"withoutCreationDate":17.8,"withEmbeddedFiles":0.7,"withIncrementalUpdates":14.6},"extremes":{"maxPages":248,"maxFileSizeMegabytes":10.3,"maxIncrementalUpdateChainRevisions":24,"oldestCreationDate":"2000-01-01"},"topProducersSharePercent":[{"tool":"iText","share":10.4},{"tool":"Microsoft Word","share":5.7},{"tool":"macOS Print to PDF","share":4.3},{"tool":"iLovePDF","share":3.8},{"tool":"PDFium","share":3.3},{"tool":"OpenPDF","share":3},{"tool":"Qt","share":2.3},{"tool":"Apache FOP","share":2.3},{"tool":"Aspose","share":2.2},{"tool":"iOS Print to PDF","share":2.2}],"topCreatorsSharePercent":[{"tool":"Microsoft Word","share":8},{"tool":"Microsoft Reporting Services","share":3.6},{"tool":"PDFium","share":3.4},{"tool":"Aspose","share":3.1},{"tool":"JasperReports","share":2.9},{"tool":"Adobe Illustrator","share":2.4},{"tool":"wkhtmltopdf","share":2.4},{"tool":"Apache FOP","share":2.3},{"tool":"Altiuz Reports","share":2.2},{"tool":"ActiveReports","share":2.1}],"pdfVersionDistributionPercent":[{"version":"1.7","share":38.3},{"version":"1.4","share":29.1},{"version":"1.5","share":13.2},{"version":"1.3","share":10.2},{"version":"1.6","share":7.3},{"version":"1.2","share":0.9},{"version":"1.1","share":0.9},{"version":"2.0","share":0.1},{"version":"unknown","share":0}],"monthlyModificationRatePercent":[{"month":"January","rate":79.4},{"month":"February","rate":67},{"month":"March","rate":31.5},{"month":"April","rate":63.9},{"month":"May","rate":68.6},{"month":"June","rate":58.3},{"month":"July","rate":73.6},{"month":"August","rate":79.1},{"month":"September","rate":19.4},{"month":"October","rate":44.9},{"month":"November","rate":67},{"month":"December","rate":63.2}],"monthlyModificationExcludedMonths":[],"verdictMixPercent":{"intact":32.6,"confirmedModified":30,"inconclusive":37.3},"modifiedConfidenceMixPercent":{"certain":52.1,"high":37.8},"originMixPercent":[{"origin":"Institutional / programmatically generated","share":55},{"origin":"Consumer software (print-to-PDF, office save)","share":23.1},{"origin":"Scanned or camera capture","share":9.7},{"origin":"unknown","share":7.2},{"origin":"Online PDF editor or converter","share":4.5},{"origin":"unverifiable","share":0.4},{"origin":"fill_sign","share":0.1},{"origin":"filled_form","share":0.1}],"documentShape":{"pageCountPercent":{"single":44,"short":37,"medium":16,"long":3},"fileSizePercent":{"under100kb":33.4,"from100kbTo1mb":57.2,"from1mbTo5mb":8.4,"over5mb":1},"averageObjectsPerDocument":123},"revisionDepthPercent":{"none":0,"one":84.1,"two":10.7,"threeOrMore":5.2},"signatureDetailPercent":{"multipleSignaturesShareOfSigned":6.2,"removedSignatureShareOfSigned":0.8},"averageDocumentAgeDays":207.4,"averageMetadataCompletenessPercent":75,"dataDictionary":[{"field":"headlineRatesPercent.modifiedShareOfConclusiveAnalyses","description":"DENOMINATOR = checks that reached a confident verdict (inconclusive consumer-grade origins excluded). Share of those found structurally modified after creation.","unit":"percent of conclusive analyses"},{"field":"headlineRatesPercent.digitallySigned","description":"DENOMINATOR = all analyzed files. Share that carry a digital signature.","unit":"percent of all analyses"},{"field":"headlineRatesPercent.embeddedJavascript","description":"DENOMINATOR = all analyzed files. Share that embed JavaScript.","unit":"percent of all analyses"},{"field":"headlineRatesPercent.signedButModifiedAfterSigning","description":"DENOMINATOR = digitally signed files only (NOT all files, NOT all modified files). Share of signed files that were modified after the signature was applied.","unit":"percent of signed files"},{"field":"structuralAnomaliesPercent","description":"DENOMINATOR = all analyzed files. Share with no creation date, with embedded files, and with incremental updates, respectively.","unit":"percent of all analyses"},{"field":"monthlyModificationRatePercent","description":"Modification rate grouped by CALENDAR MONTH, pooled across all years in the sample (not a chronological time series). A month is omitted entirely when it holds fewer than 20 analyses, so a low-sample month never shows as a headline rate.","unit":"percent modified within the month"},{"field":"monthlyModificationExcludedMonths","description":"Calendar months withheld from monthlyModificationRatePercent because they hold too few analyses to publish. Listed explicitly so a gap reads as a deliberate suppression, not a generation error.","unit":"month names"},{"field":"analysisPeriod","description":"ISO date range over which the analyses in this sample were RUN (when files were checked), distinct from temporalCoverage, which is the range of the documents’ own creation dates.","unit":"ISO date range"},{"field":"sampleMagnitude","description":"Order-of-magnitude size of the sample (e.g. \"tens of thousands\"), published as a coarse bucket rather than an exact count so a reader can gauge statistical weight without the precise number of analyses being disclosed.","unit":"magnitude bucket"},{"field":"verdictMixPercent","description":"How every analyzed file split across the three possible verdicts: intact, confirmed-modified, and inconclusive (origin could not be pinned to a determinable class).","unit":"percent of all analyses"},{"field":"modifiedConfidenceMixPercent","description":"Among confirmed-modified files, the split between certain and high confidence in the modification finding.","unit":"percent of modified"},{"field":"originMixPercent","description":"Distribution of files by detected origin class: institutional/programmatic, consumer software, online editor, or scan.","unit":"percent of all analyses"},{"field":"documentShape.pageCountPercent","description":"Distribution by page count: single, short (2–5), medium (6–20), long (21+).","unit":"percent"},{"field":"documentShape.fileSizePercent","description":"Distribution by file size: under 100 KB, 100 KB–1 MB, 1–5 MB, over 5 MB.","unit":"percent"},{"field":"documentShape.averageObjectsPerDocument","description":"Mean count of PDF objects per analyzed document.","unit":"count"},{"field":"revisionDepthPercent","description":"Distribution by number of incremental-update revision layers: none, one, two, three-or-more.","unit":"percent"},{"field":"signatureDetailPercent","description":"Among digitally signed files: share carrying more than one signature, and share where a signature was removed.","unit":"percent of signed"},{"field":"averageDocumentAgeDays","description":"Mean gap between a document’s creation date and the moment it was analyzed.","unit":"days"},{"field":"averageMetadataCompletenessPercent","description":"Mean completeness of the standard metadata fields, scored 0–100.","unit":"percent"}]}