Edited PDF Detector
There is no single "edited" flag in a PDF, but there are several reliable signals — modification dates, incremental update sections, XMP history and structural inconsistencies. Used together they tell you a lot; none of them alone proves anything.
Compare PDFs
Try it on a copy of your document — keep the original until you have checked the result.
Compare PDFs
Signal 1 — metadata timestamps
- Document properties expose CreationDate and ModDate. A ModDate later than CreationDate means the file was saved again after creation.
- Caveat: timestamps are trivially editable and depend on the writer's clock. Treat them as indicative, not proof.
Signal 2 — incremental updates
- PDFs can be updated by appending changes rather than rewriting. An edited file often contains multiple revisions followed by %%EOF markers, with an /XRef stream pointing to the newest.
- Multiple %%EOF occurrences are a strong indicator of post-creation modification.
Signal 3 — XMP metadata history
- XMP packets can carry a resource history: when it was created, by which tool, and when last modified. Compare xmp:ModifyDate against xmp:CreateDate and against the document information dictionary — mismatches are telling.
Signal 4 — structural inconsistency
- Producer versus creator mismatch: content claiming one application while the producer field names another suggests re-saving through a different tool.
- Object numbering gaps or linearisation remnants can indicate reconstruction.
- Annotation or form objects with modification dates later than the page content.
Honest limits
- None of these prove intent or identify what changed. A re-saved PDF with identical content looks the same as an edited one.
- A determined party can normalise metadata. Absence of signals is not evidence of authenticity.
- For disputes, use a forensic examiner — automated checks are triage, not conclusions.
Caution: Automated checks are indicative only. Metadata can be rewritten, so absence of signals does not prove a document is unmodified. Use a qualified examiner for evidential matters.
Step by step
- Read document properties: compare creation and modification dates.
- Inspect the raw file for multiple %%EOF markers (incremental updates).
- Review XMP history for create/modify mismatches.
- Cross-check producer against the claimed creating application.
- Treat findings as triage; escalate to a forensic examiner if it matters.
PDFnoted product team · Published 2026-09-02
Based on how PDF annotation objects, page content streams and document metadata are defined in the PDF specification, and on the behaviour of PDFnoted’s own tools. Reviewed periodically.
General guidance for document handling only; not legal advice. Where a document may be used as evidence, keep an unmodified original and consult a qualified professional.
FAQ
- How can I tell if a PDF has been edited?
- Combine signals: creation versus modification dates, multiple %%EOF markers indicating incremental updates, XMP history mismatches, and producer/creator inconsistencies. No single signal is conclusive.
- Is there a definitive "edited" flag in PDFs?
- No. PDFs have no authoritative edited marker — only metadata and structural evidence, both of which can be altered.
- What are incremental updates?
- PDFs can be updated by appending changes instead of rewriting the file. Appended revisions leave extra %%EOF markers and cross-reference sections — a strong sign of post-creation modification.
- Can metadata be faked?
- Yes. Creation and modification dates are ordinary fields and can be set to anything. Do not rely on them alone.
- Does a missing modification signal mean the file is original?
- No. Tools can normalise or rewrite metadata, erasing the traces. Absence of evidence is not evidence of authenticity.
- Can I detect what specifically was changed?
- Only with version comparison against an earlier copy. Without a reference version, you can detect that changes occurred, not what they were.
- What about signatures — do they prove integrity?
- A valid digital signature covers byte ranges and is far stronger evidence; if the signature verifies, the signed content is unaltered. A signature image alone proves nothing.
- Should I rely on an online detector for legal matters?
- Use it for triage only. For anything evidential, instruct a qualified digital forensics examiner.