logologo
  • How it works
  • Why It Matters
  • Statistics
  • Pricing
  • API
logologo
  • How it works
  • Why It Matters
  • Statistics
  • Pricing
  • API
HTPBE?

Structural PDF tamper detection API. Catches edits your KYC stack misses.

Product

  • How It Works
  • Why It Matters
  • Use Cases
  • Pricing

Developers

  • API Reference
  • GitHub/docs
  • Changelogv2.23.1

Resources

  • FAQ
  • Blog
  • Comparisons
  • Legal & Imprint

© 2024–2026 TMI Iurii Rogulia · VAT ID: FI29845875 · Made in Finland 🇫🇮

Status

Algorithm v2.23.1

Tool profile

pdf-lib

pdf-lib reads as a downstream re-saver — it surfaces disproportionately on documents whose original Creator was a different, often institutional, application.

Back to all statistics
Forensic verdict

Anomaly profile

Based on 74 appearances across the HTPBE? corpus.

Modification rate
85%+37pp above baseline
Corpus baseline: 48%
Total appearances
74
0.35% of corpus
Modification rate
85%
+37pp above baseline
Role split
47%C/53%P
Creator vs Producer share of appearances

Corpus profile

How pdf-lib shows up in HTPBE? corpus

pdf-lib is a JavaScript/TypeScript library for creating and modifying PDFs in Node.js and the browser. Common in SaaS form-fill products and bespoke document tools.

pdf-lib appears both as the original generator on JS-stack SaaS output and as a downstream re-saver on documents that originated elsewhere. Signal: when pdf-lib is the latest Producer on a document whose Creator was an institutional source, that producer/creator mismatch is one of the markers we surface.

The signal
pdf-lib appears both as the original generator on JS-stack SaaS output and as a downstream re-saver on documents that originated elsewhere.

Role in the workflow

How pdf-lib shows up in metadata

Every PDF carries a Creator (the application that produced the original document) and a Producer (the engine that wrote the PDF). The same tool can appear in either slot, with very different modification profiles.

CAs Creator · 47%
As Producer · 53%P
CAs Creator
  • Usage
    35
  • Modification rate
    86%
  • Avg file size
    397 KB
PAs Producer
  • Usage
    39
  • Modification rate
    85%
  • Avg file size
    440 KB

How to read this

The Creator slot typically reflects where a document started life. The Producer slot reflects whatever wrote the bytes — and is the field that gets overwritten when a PDF is opened, edited, and saved by a downstream tool.

A higher modification rate as Producer than as Creator usually means the tool is acting as a re-saver on documents that originated elsewhere. A higher rate as Creator points to fragile workflows around the original authoring app.

Distributions

What ships alongside pdf-lib

The PDF versions pdf-lib writes when acting as Producer, and the other tools that appear in the same documents.

PDF versions written

Most output is PDF 1.7 (100% of files where pdf-lib is the Producer).

PDF 1.7100.0%

Common Creators when pdf-lib is the Producer

pdf-lib sits upstream in 87% of cases — read this row as “what kinds of documents end up routed through pdf-lib.”

pdf-lib87.2%
Acrobat PDFMaker2.6%
Microsoft Word2.6%
VCTransaction2.6%
Google Sheets2.6%
PDFium2.6%

Related profiles

Tools you’ll see next to pdf-lib

Other tools that frequently share metadata with pdf-lib in the same documents. Each card links to its own forensic profile.

C1% co-occurrence
Acrobat PDFMaker
Appearances29
Mod rate86%
C1% co-occurrence
Microsoft Word
Appearances2,124
Mod rate81%
C1% co-occurrence
VCTransaction
Appearances34
Mod rate65%
C1% co-occurrence
Google Sheets
Appearances6
Mod rate0%
C1% co-occurrence
PDFium
Appearances962
Mod rate25%

Long tail

Notable observations

Smaller cuts of the pdf-lib corpus — useful context, but treat each row as a single data point rather than a strong signal.

Embedded files
1

PDFs with attached files inside

Pages parsed
503
Oldest observed
16 Sep 2022 — over 3 years ago

Secure your workflow

Create your account — API key on signup, free test environment on every plan.
From $15/mo. No sales call. Cancel any time.

Start free — close the structural fraud gapSee pricing
Read API docs →