logologo
  • How it works
  • Why It Matters
  • Statistics
  • Pricing
  • API
logologo
  • How it works
  • Why It Matters
  • Statistics
  • Pricing
  • API
HTPBE?

Structural PDF tamper detection API. Catches edits your KYC stack misses.

Product

  • How It Works
  • Why It Matters
  • Use Cases
  • Pricing

Developers

  • API Reference
  • GitHub/docs
  • Changelogv2.23.1

Resources

  • FAQ
  • Blog
  • Comparisons
  • Legal & Imprint

© 2024–2026 TMI Iurii Rogulia · VAT ID: FI29845875 · Made in Finland 🇫🇮

Status

Algorithm v2.23.1

Tool profile

iText

iText reads as a downstream re-saver — it surfaces disproportionately on documents whose original Creator was a different, often institutional, application.

Back to all statistics
Forensic verdict

Anomaly profile

Based on 1,717 appearances across the HTPBE? corpus.

Modification rate
46%-2pp below baseline
Corpus baseline: 48%
Total appearances
1,717
8.2% of corpus
Modification rate
46%
-2pp below baseline
Role split
0%C/100%P
Creator vs Producer share of appearances

Corpus profile

How iText shows up in HTPBE? corpus

iText is a Java/.NET PDF library used both for legitimate server-side document generation (custom invoicing, archival workflows) and for programmatic post-processing such as merging, stamping, and field-flattening.

iText appears in HTPBE? across both legitimate first-generation output and flagged documents where it shows up post-original creation. Signal: when iText is the latest Producer on a document whose Creator was an institutional source like Adobe PDF Library or Microsoft Word, that producer/creator mismatch is one of the markers we surface.

The signal
iText appears in HTPBE? across both legitimate first-generation output and flagged documents where it shows up post-original creation.

Role in the workflow

How iText shows up in metadata

Every PDF carries a Creator (the application that produced the original document) and a Producer (the engine that wrote the PDF). The same tool can appear in either slot, with very different modification profiles.

CAs Creator · 0%
As Producer · 100%P
CAs Creator
  • Usage
    0
  • Modification rate
    0%
PAs Producer
  • Usage
    1,717
  • Modification rate
    46%
  • Avg file size
    208 KB

How to read this

The Creator slot typically reflects where a document started life. The Producer slot reflects whatever wrote the bytes — and is the field that gets overwritten when a PDF is opened, edited, and saved by a downstream tool.

A higher modification rate as Producer than as Creator usually means the tool is acting as a re-saver on documents that originated elsewhere. A higher rate as Creator points to fragile workflows around the original authoring app.

Name fingerprints

Also goes by

Different version strings and spellings observed for iText in the wild. All are merged into the same canonical profile.

iText 2.1.7 by 1T3XT50.8%
iText® Core 8.0.5 (AGPL version), pdfHTML 5.0.5 (AGPL version) ©2000-2024 Apryse Group NV11.9%
iTextSharp.LGPLv2.Core 3.7.1.08.3%
iText® 7.1.1 ©2000-2018 iText Group NV (Macquarie Group Services Australia; licensed version)7.6%
iTextSharp™ 5.5.10 ©2000-2016 iText Group NV (AGPL-version)4.9%
iTextSharp 4.1.6 by 1T3XT4.4%
iText 2.1.2 (by lowagie.com)3.2%
iText 2.0.8 (by lowagie.com)1.1%
iText 2.1.5 (by lowagie.com)1.0%
iText® 5.5.0 ©2000-2013 iText Group NV (AGPL-version)0.6%
iText® 7.0.5 ©2000-2017 iText Group NV (AGPL-version); modified using iText® 5.5.13.3 ©2000-2022 iText Group NV (AGPL-version)0.6%
iText 1.4 (by lowagie.com)0.4%
iText® 5.5.11 ©2000-2017 iText Group NV (AGPL-version)0.3%
iTextSharp™ 5.5.13.2 ©2000-2020 iText Group NV (AGPL-version); modified using iTextSharp™ 5.5.13.2 ©2000-2020 iText Group NV (AGPL-version)0.3%
iText® 7.1.9-SNAPSHOT ©2000-2019 iText Group NV (MICROSOFT; licensed version)0.2%
iText® 5.5.13 ©2000-2018 iText Group NV (PayPal, Inc.; licensed version)0.2%
iText 2.0.4 (by lowagie.com)0.2%
iText® 5.4.1 ©2000-2012 1T3XT BVBA (AGPL-version)0.2%
iText® 5.5.13.3 ©2000-2022 iText Group NV (AGPL-version)0.2%
iText® Core 8.0.2 (AGPL version) ©2000-2023 Apryse Group NV0.2%
iText® Core 9.1.0 (AGPL version), pdfHTML 6.1.0 (AGPL version) ©2000-2025 Apryse Group NV0.2%
iText® 7.1.12 ©2000-2020 iText Group NV (Tata Consultancy Services Limited; licensed version); modified using iText® 7.1.12 ©2000-2020 iText Group NV (Tata Consultancy Services Limited; licensed version); modified using emBridge0.2%
iText® 5.5.13.2 ©2000-2020 iText Group NV (AGPL-version)0.2%
iText® 5.3.1 ©2000-2012 1T3XT BVBA (AGPL-version)0.2%
iText® Core 8.0.0 (AGPL version), pdfHTML 4.0.2 (AGPL version) ©2000-2023 Apryse Group NV0.2%
iText 2.1.7 by 1T3XT; modified using iText® 7.1.12 ©2000-2020 iText Group NV (AGPL-version)0.1%
iText® 5.5.4 ©2000-2014 iText Group NV (AGPL-version); modified using iText® 5.5.4 ©2000-2014 iText Group NV (AGPL-version)0.1%
iText® 5.2.0 ©2000-2012 1T3XT BVBA0.1%
iText® Core 7.2.5 (production version) ©2000-2023 Apryse Group NV, MAC D4005-0100.1%
iText 5.0.1 (c) 1T3XT BVBA0.1%
iText® Core 8.0.5 (AGPL version) ©2000-2024 Apryse Group NV0.1%
iText® 5.5.13 ©2000-2018 iText Group NV (AGPL-version); modified using iText® 5.5.13 ©2000-2018 iText Group NV (AGPL-version)0.1%
iText 2.1.6 by 1T3XT; modified using iText® 5.2.1 ©2000-2012 1T3XT BVBA0.1%
iText 2.1.0 (by lowagie.com)0.1%
iText® Core 9.2.0 (AGPL version) ©2000-2025 Apryse Group NV0.1%
iText® 5.5.13 ©2000-2018 iText Group NV (AGPL-version)0.1%
iText® Core 7.2.5 (AGPL version) ©2000-2023 Apryse Group NV0.1%
iTextSharp™ 5.5.13 ©2000-2018 iText Group NV (AGPL-version)0.1%
iTextSharp™ 5.5.13.3 ©2000-2022 iText Group NV (AGPL-version)0.1%
iText 2.1.4 (by lowagie.com)0.1%
iText® 5.5.13 ©2000-2018 iText Group NV (PayPal, Inc.; licensed version) (PayPal, Inc.; licensed version)0.1%
iText 4.2.0 by 1T3XT0.1%
iText® 5.5.12 ©2000-2017 iText Group NV (APPLE, INC.; licensed version) (APPLE, INC.; licensed version) (APPLE, INC.; licensed version) (APPLE, INC.; licensed version) (APPLE, INC.; licensed version)0.1%
iTextSharp™ 5.4.2 ©2000-2012 1T3XT BVBA (AGPL-version)0.1%
iText® 7.1.4 ©2000-2018 iText Group NV (Fuji Xerox Document Management Solutions; licensed version)0.1%
iText® Core 7.2.6 (production version) ©2000-2024 Apryse Group NV, Paysafe Bulgaria ltd0.1%
iText® pdfHTML 4.0.2 (AGPL version) ©2000-2022 iText Group NV0.1%
iTextSharp™ 5.3.5 ©2000-2012 1T3XT BVBA (AGPL-version)0.1%
iText® Core 8.0.5 (AGPL version), pdfHTML 5.0.5 (AGPL version) ©2000-2024 Apryse Group NV0.1%
iTextSharp™ 5.5.11 ©2000-2017 iText Group NV (AGPL-version); modified using iTextSharp™ 5.5.11 ©2000-2017 iText Group NV (AGPL-version)0.1%
iTextSharp™ 5.4.0 ©2000-2012 1T3XT BVBA (AGPL-version)0.1%
iText® 7.1.4 ©2000-2018 iText Group NV (AGPL-version)0.1%
iText 2.1.3 (by lowagie.com)0.1%
iTextSharp™ 5.5.13.3 ©2000-2022 iText Group NV (Ceridian Dayforce Inc.; licensed version)0.1%
itext-paulo-155 (itextpdf.sf.net - lowagie.com)0.1%
iText® 5.5.4 ©2000-2014 iText Group NV (AGPL-version)0.1%
iText® Core 9.5.0 (AGPL version) ©2000-2025 Apryse Group NV0.1%

Why variants matter

The same tool publishes itself under 57 different metadata strings — version bumps, locale tags, build IDs. We canonicalize them so the corpus reflects one identity, not noise.

Most common
iText 2.1.7 by 1T3XT
50.8% of appearances
Variant spread
57 distinct strings
Long-tail share: 49.2%
Observed range
5 Apr 2019 → 22 May 2026

Distributions

What ships alongside iText

The PDF versions iText writes when acting as Producer, and the other tools that appear in the same documents.

PDF versions written

Most output is PDF 1.4 (40% of files where iText is the Producer).

PDF 1.440.1%
PDF 1.731.5%
PDF 1.520.0%
PDF 1.37.1%
PDF 1.61.2%
PDF 2.00.1%

Common Creators when iText is the Producer

JasperReports sits upstream in 44% of cases — read this row as “what kinds of documents end up routed through iText.”

JasperReports44.1%
Altiuz Reports37.0%
Aspose14.6%
Adobe Photoshop1.9%
ESTAT0.6%
BIRT Report Engine0.6%
Microsoft Windows Photo Viewer0.3%
Microsoft Word0.3%
Adobe Illustrator0.3%
VBMS-C0.3%

Related profiles

Tools you’ll see next to iText

Other tools that frequently share metadata with iText in the same documents. Each card links to its own forensic profile.

C17% co-occurrence
JasperReports
Appearances482
Mod rate14%
C14% co-occurrence
Altiuz Reports
Appearances362
Mod rate100%
C5% co-occurrence
Aspose
Appearances870
Mod rate39%
C1% co-occurrence
Adobe Photoshop
Appearances46
Mod rate72%
C0% co-occurrence
ESTAT
Appearances4
Mod rate50%

Long tail

Notable observations

Smaller cuts of the iText corpus — useful context, but treat each row as a single data point rather than a strong signal.

Embedded JavaScript
1

Files containing JavaScript code

Digitally signed
14

PDFs carrying at least one digital signature

Pages parsed
2,739
Largest document
105 pages
Oldest observed
5 Apr 2019 — about 7 years ago

Secure your workflow

Create your account — API key on signup, free test environment on every plan.
From $15/mo. No sales call. Cancel any time.

Start free — close the structural fraud gapSee pricing
Read API docs →