logologo
  • How it works
  • Why It Matters
  • Statistics
  • Pricing
  • API
logologo
  • How it works
  • Why It Matters
  • Statistics
  • Pricing
  • API
HTPBE?

Structural PDF tamper detection API. Catches edits your KYC stack misses.

Product

  • How It Works
  • Why It Matters
  • Use Cases
  • Pricing

Developers

  • API Reference
  • GitHub/docs
  • Changelogv2.23.1

Resources

  • FAQ
  • Blog
  • Comparisons
  • Legal & Imprint

© 2024–2026 TMI Iurii Rogulia · VAT ID: FI29845875 · Made in Finland 🇫🇮

Status

Algorithm v2.23.1

Tool profile

iOS Print to PDF

iOS Print to PDF appears on both legitimate first-generation output and downstream re-save flows — context (the other tool on the same document) is what flips the signal.

Back to all statistics
Forensic verdict

Mixed signal

Based on 347 appearances across the HTPBE? corpus.

Modification rate
68%+20pp above baseline
Corpus baseline: 48%
Total appearances
347
1.7% of corpus
Modification rate
68%
+20pp above baseline
Role split
0%C/100%P
Creator vs Producer share of appearances

Corpus profile

How iOS Print to PDF shows up in HTPBE? corpus

iOS Print to PDF is the iPhone/iPad equivalent of the macOS Print to PDF pipeline, invoked via the "Save to Files" or share-sheet PDF action.

Documents with iOS Print to PDF as Producer were generated on a mobile Apple device in one pass. Low signal in tampered corpus on its own.

The signal
Documents with iOS Print to PDF as Producer were generated on a mobile Apple device in one pass.

Role in the workflow

How iOS Print to PDF shows up in metadata

Every PDF carries a Creator (the application that produced the original document) and a Producer (the engine that wrote the PDF). The same tool can appear in either slot, with very different modification profiles.

CAs Creator · 0%
As Producer · 100%P
CAs Creator
  • Usage
    0
  • Modification rate
    0%
PAs Producer
  • Usage
    347
  • Modification rate
    68%
  • Avg file size
    859 KB

How to read this

The Creator slot typically reflects where a document started life. The Producer slot reflects whatever wrote the bytes — and is the field that gets overwritten when a PDF is opened, edited, and saved by a downstream tool.

A higher modification rate as Producer than as Creator usually means the tool is acting as a re-saver on documents that originated elsewhere. A higher rate as Creator points to fragile workflows around the original authoring app.

Name fingerprints

Also goes by

Different version strings and spellings observed for iOS Print to PDF in the wild. All are merged into the same canonical profile.

iOS Version 18.5 (Build 22F76) Quartz PDFContext; modified using iText® 5.5.13.2 ©2000-2020 iText Group NV (AGPL-version)35.7%
iOS Version 26.1 (Build 23B85) Quartz PDFContext25.6%
iOS Version 26.3.1 (Build 23D8133) Quartz PDFContext9.2%
iOS Version 26.2.1 (Build 23C71) Quartz PDFContext7.2%
iOS Version 26.3.1 (a) (Build 23D771330a) Quartz PDFContext6.1%
iOS Version 18.6.2 (Build 22G100) Quartz PDFContext2.6%
iOS Version 16.6 (Build 20G75) Quartz PDFContext1.7%
iOS Version 26.3 (Build 23D127) Quartz PDFContext1.4%
iOS Version 26.4.2 (Build 23E261) Quartz PDFContext1.2%
iOS Version 18.5 (Build 22F76) Quartz PDFContext1.2%
iOS Version 18.3.2 (Build 22D82) Quartz PDFContext0.9%
iOS Version 17.5.1 (Build 21F90) Quartz PDFContext0.9%
iOS Version 26.0 (Build 23A341) Quartz PDFContext, AppendMode 1.10.9%
iOS Version 26.2 (Build 23C55) Quartz PDFContext0.9%
iOS Version 16.4.1 (Build 20E252) Quartz PDFContext0.6%
iOS Version 18.1.1 (Build 22B91) Quartz PDFContext0.6%
iOS Version 15.4.1 (Build 19E258) Quartz PDFContext0.3%
iOS Version 18.7.6 (Build 22H320) Quartz PDFContext0.3%
iOS Version 18.7.8 (Build 22H352) Quartz PDFContext0.3%
iOS Version 18.3.1 (Build 22D72) Quartz PDFContext0.3%
iOS Version 26.0 (Build 23A341) Quartz PDFContext0.3%
iOS Version 18.4.1 (Build 22E252) Quartz PDFContext0.3%
iOS Version 16.0 (Build 20A362) Quartz PDFContext, AppendMode 1.10.3%
iOS Version 18.7.3 (Build 22H217) Quartz PDFContext0.3%
iOS Version 18.2.1 (Build 22C161) Quartz PDFContext, AppendMode 1.10.3%
iOS Version 16.7.10 (Build 20H350) Quartz PDFContext0.3%
iOS Version 26.4 (Build 23E5207q) Quartz PDFContext0.3%
iOS Version 26.2.1 (Build 23C71) Quartz PDFContext, AppendMode 1.10.3%

Why variants matter

The same tool publishes itself under 28 different metadata strings — version bumps, locale tags, build IDs. We canonicalize them so the corpus reflects one identity, not noise.

Most common
iOS Version 18.5 (Build 22F76) Quartz PDFContext; modified using iText® 5.5.13.2 ©2000-2020 iText Group NV (AGPL-version)
35.7% of appearances
Variant spread
28 distinct strings
Long-tail share: 64.3%
Observed range
19 Oct 2022 → 19 May 2026

Distributions

What ships alongside iOS Print to PDF

The PDF versions iOS Print to PDF writes when acting as Producer, and the other tools that appear in the same documents.

PDF versions written

Most output is PDF 1.3 (97% of files where iOS Print to PDF is the Producer).

PDF 1.397.3%
PDF 1.72.3%
PDF 1.60.3%

Common Creators when iOS Print to PDF is the Producer

Microsoft Word sits upstream in 74% of cases — read this row as “what kinds of documents end up routed through iOS Print to PDF.”

Microsoft Word74.1%
Photos6.3%
Scanner iScanner3.6%
Dropbox2.7%
Safari2.7%
KP2.7%
MyChart2.7%
PDFium1.8%
PDF Expert1.8%
PRO HLCAPI1.8%

Related profiles

Tools you’ll see next to iOS Print to PDF

Other tools that frequently share metadata with iOS Print to PDF in the same documents. Each card links to its own forensic profile.

C24% co-occurrence
Microsoft Word
Appearances2,124
Mod rate81%
C2% co-occurrence
Photos
Appearances7
Mod rate43%
C1% co-occurrence
Scanner iScanner
Appearances4
Mod rate0%
C1% co-occurrence
Dropbox
Appearances13
Mod rate62%
C1% co-occurrence
Safari
Appearances6
Mod rate50%

Long tail

Notable observations

Smaller cuts of the iOS Print to PDF corpus — useful context, but treat each row as a single data point rather than a strong signal.

Pages parsed
620
Oldest observed
19 Oct 2022 — over 3 years ago

Secure your workflow

Create your account — API key on signup, free test environment on every plan.
From $15/mo. No sales call. Cancel any time.

Start free — close the structural fraud gapSee pricing
Read API docs →