Sometimes, but not with certainty. A PDF often keeps traces of being changed: a modified date later than its created date, a second program in its details, or earlier saved versions still inside the file. These are clues, not proof. Most have innocent causes, and someone careful can remove them. The only reliable checks are a valid digital signature or a comparison with the original.
The signs a PDF was changed after it was made
When you open a PDF in Verify Metadata or a viewer’s document properties, these are the details that suggest it was edited. Each has a common, harmless explanation too, so look at them together rather than one at a time.
| Sign | What it can mean | Common innocent reason |
|---|---|---|
| Modified date later than created date | The file was saved again after it was made | Someone added a comment, filled a form or re-saved it |
| Producer differs from Creator | A second program wrote the PDF | It was compressed, merged or printed to PDF |
| More than one saved version | Changes were added to the end of the file | Normal behaviour for many PDF editors and form fillers |
| XMP and document details disagree | One store was updated and the other wasn’t | Some programs only update one of them |
| A signature that no longer validates | The file changed after it was signed | A later save that wasn’t a permitted signed change |
Modified date after created date
Every PDF stores a created date and a modified date. The created date is set once. The modified date moves forward each time a program saves the file. If they differ, the file was saved again later.
This is the most common sign, and the least telling. Filling in a form, adding a highlight or saving an attachment again will all update it. A big gap, though, such as a contract created in March and modified in October, tells you the file was opened and saved long after it was made. Whether that matters depends on what was supposed to happen to it.
A second program in the details
The Creator field names the program the content was written in, and the Producer field names the program that wrote the PDF. When a Word document is exported to PDF, both usually point to Word. If the Producer is a PDF editor, an online converter or a scanning app, the file passed through a second program.
That often happens for ordinary reasons: compressing a large file, merging documents, or printing to PDF. It is still useful context. If someone tells you a PDF came straight from their accounts software, but the Producer is a general-purpose PDF editor, it is fair to ask why.
Earlier versions inside the file
Many programs save PDFs by incremental update: rather than rewriting the file, they add the changes to the end and leave the earlier version in place below. Each save adds a new section, ending with its own end-of-file marker. A file with several of these sections has been saved several times.
Verify Metadata counts these saved versions for you. One version means the file was written once and never added to. Several mean it was changed later, which is normal for forms and comments, and worth noticing for documents that should be final.
Two sets of details that disagree
PDFs can store their details twice: in the document information dictionary and in an XMP data block. Software that edits a PDF sometimes updates one and not the other. When the title, author or dates differ between the two, the file was changed by a program that didn’t keep them in step.
What metadata can’t prove
It helps to be clear about the limits, because metadata is easy to over-read.
- Clean details don’t mean an untouched file. Every field can be edited, and a file rewritten from scratch shows one version and no history.
- Odd details don’t mean fraud. Wrong computer clocks, careless software and routine re-saving explain most strange results.
- Metadata says nothing about the visible content. It can’t tell you whether a figure on the page is true.
How to check a document properly
If it matters whether a PDF was altered, go beyond the metadata.
- Check for a digital signature. In Adobe Acrobat Reader, open the Signature panel. A valid signature confirms who signed and whether the document has changed since. This is the strongest check available inside the file.
- Compare with the source. Ask the sender, or the organisation that issued it, for the original, or check the figures directly with them.
- Compare fingerprints. If you have two copies, a file hash (such as SHA-256) shows whether they are byte-for-byte identical. On Windows,
certutil -hashfile file.pdf SHA256prints one; on a Mac, useshasum -a 256 file.pdf. - Look at the metadata last, as context. Use it to decide which questions to ask, not to reach a conclusion.
PDF Check’s own Metadata Editor deliberately can’t change dates. When you save an edit, the modified date records the real time of the change, so the file stays honest about when it was changed.
Frequently asked questions
Can you tell when a PDF was last edited?
Usually. The modified date in the document properties shows when the file was last saved. It follows the clock of the computer that saved it, and it can be edited, so treat it as a strong hint rather than proof.
Does editing a PDF change its metadata?
Almost always. Saving an edit updates the modified date, and many editors add their own name to the Producer field or add a new saved version to the end of the file.
Can you tell if a PDF bank statement or invoice was changed?
Metadata can suggest it, for example a general PDF editor in the Producer field of a statement that should come straight from a bank’s system. The reliable check is to compare it with the issuer’s own records, or to confirm a digital signature if the document has one.
Is there a way to prove a PDF hasn’t been altered?
A valid digital signature is the strongest proof inside the file itself. Outside it, comparing a file hash with a copy you trust shows whether the two are identical.
