Tool profile

iText

iText reads as a downstream re-saver — it surfaces disproportionately on documents whose original Creator was a different, often institutional, application.

Back to all statistics

Forensic verdict

Anomaly profile

Based on this tool’s share of the HTPBE? corpus.

Modification rate

46%-2pp below baseline

Corpus baseline: 48%

Corpus share

7.9%

Share of all analyzed appearances

Modification rate

46%

-2pp below baseline

Role split

0%C/100%P

Creator vs Producer share of appearances

Corpus profile

How iText shows up in HTPBE? corpus

iText is a Java/.NET PDF library used both for legitimate server-side document generation (custom invoicing, archival workflows) and for programmatic post-processing such as merging, stamping, and field-flattening.

iText appears in HTPBE? across both legitimate first-generation output and flagged documents where it shows up post-original creation. Signal: when iText is the latest Producer on a document whose Creator was an institutional source like Adobe PDF Library or Microsoft Word, that producer/creator mismatch is one of the markers we surface.

Role in the workflow

How iText shows up in metadata

Every PDF carries a Creator (the application that produced the original document) and a Producer (the engine that wrote the PDF). The same tool can appear in either slot, with very different modification profiles.

CAs Creator · 0%

As Producer · 100%P

CAs Creator

Share of appearances
0%
Modification rate
0%

PAs Producer

Share of appearances
100%
Modification rate
46%
Avg file size
208 KB

Name fingerprints

Also goes by

Different version strings and spellings observed for iText in the wild. All are merged into the same canonical profile.

iText 2.1.7 by 1T3XT50.3%

iTextSharp.LGPLv2.Core 3.7.1.08.0%

iTextSharp 4.1.6 by 1T3XT4.2%

iText 2.1.2 (by lowagie.com)3.1%

iText 2.0.8 (by lowagie.com)1.2%

iText 2.1.5 (by lowagie.com)1.0%

iText 1.4 (by lowagie.com)0.4%

iText 2.0.4 (by lowagie.com)0.2%

iText® 7.1.12 ©2000-2020 iText Group NV (Tata Consultancy Services Limited; licensed version); modified using iText® 7.1.12 ©2000-2020 iText Group NV (Tata Consultancy Services Limited; licensed version); modified using emBridge0.2%

iText 5.0.1 (c) 1T3XT BVBA0.1%

iText 2.1.0 (by lowagie.com)0.1%

iText 5.5.13.4 2000-2024 iText Group NV (AGPL-version)0.1%

iText 2.1.4 (by lowagie.com)0.1%

iText 4.2.0 by 1T3XT0.1%

iText® 5.5.12 ©2000-2017 iText Group NV (APPLE, INC.; licensed version) (APPLE, INC.; licensed version) (APPLE, INC.; licensed version) (APPLE, INC.; licensed version) (APPLE, INC.; licensed version)0.1%

iText 1.4.8 (by lowagie.com)0.1%

iText 2.1.3 (by lowagie.com)0.1%

itext-paulo-155 (itextpdf.sf.net - lowagie.com)0.1%

Why variants matter

The same tool publishes itself under 66 different metadata strings — version bumps, locale tags, build IDs. We canonicalize them so the corpus reflects one identity, not noise.

Most common

iText 2.1.7 by 1T3XT

50.3% of appearances

Variant spread

66 distinct strings

Long-tail share: 49.7%

Observed range

05.04.2019 → 08.07.2026

Distributions

What ships alongside iText

The PDF versions iText writes when acting as Producer, and the other tools that appear in the same documents.

PDF versions written

Most output is PDF 1.4 (41% of files where iText is the Producer).

PDF 1.440.6%

PDF 1.731.4%

PDF 1.519.6%

PDF 1.36.9%

PDF 1.61.4%

PDF 2.00.1%

Common Creators when iText is the Producer

JasperReports sits upstream in 44% of cases — read this row as “what kinds of documents end up routed through iText.”

JasperReports44.0%

Altiuz Reports36.8%

Aspose14.6%

Adobe Photoshop1.9%

IRS EIN Assistant0.6%

BIRT Report Engine0.6%

ESTAT0.6%

Microsoft Windows Photo Viewer0.3%

Microsoft Word0.3%

Canva0.3%

Related profiles

Tools you’ll see next to iText

Other tools that frequently share metadata with iText in the same documents. Each card links to its own forensic profile.

Long tail

Notable observations

Smaller cuts of the iText corpus — useful context, but treat each row as a single data point rather than a strong signal.

Embedded JavaScript

<1%

Of files contain JavaScript code

Digitally signed

Of files carry at least one digital signature

Avg pages per document

1.7

Largest document

105 pages

Oldest observed

05.04.2019 — over 7 years ago

Secure your workflow

Create your account — API key on signup, free test environment on every plan.
From $15/mo. No sales call. Cancel any time.

Start Free — Close the Structural Fraud Gap See Pricing

Read API Docs →