A PDF looks final the moment you open it, but the file itself often remembers more than it shows on screen. Learning how to check if a PDF has been tampered with starts with knowing that a PDF isn't really a flat, one-shot document -- it's a small structured file format, and edits can leave traces behind even when the visible page looks untouched.
This matters most for contracts, invoices, signed agreements, and anything else where "was this the original?" actually has consequences.
What's actually hiding inside a PDF file
Every PDF carries a metadata dictionary -- creation date, modification date, and the name of the application that produced it -- separate from anything visible on the page. Many PDFs also save edits incrementally rather than rewriting the whole file, meaning a document can technically contain more than one version of itself layered on top of each other.
Signs a PDF may have been edited after the fact
- A modification date that's inconsistent with when the document was supposedly finalized.
- Evidence of more than one save pass, suggesting the file was reopened and changed after its first version.
- A producer or creator application field that doesn't match the software the sender claims they used.
- Fonts or formatting that shift partway through the document, hinting different sections came from different sources or times.
Why metadata alone isn't proof
It's worth being honest about the limits here: metadata can be edited, stripped, or faked by anyone who knows to look for it, so none of this is a smoking gun on its own. Think of a metadata check as the first thing you'd look at, not the last -- a reason to ask more questions or request the original file, not a courtroom-ready conclusion.
How to actually check a PDF, step by step
PDF inFOOT
Digs into a PDF's history, metadata, and possible tampering, and reports what it finds in plain language -- free, no upload.
Upload the file to our free PDF inFOOT tool and it reads the document's internal structure -- metadata fields, revision markers, and producer information -- and lays out anything unusual in plain language instead of a raw technical dump. It's built to be the first thing you check, not the last word.
What to do if you find something suspicious
If inFOOT flags something worth a second look, the next steps are straightforward: ask the sender for the original file rather than a forwarded copy, compare it line-by-line against a known-good version with our Compare PDF tool, and if the stakes are genuinely high -- a legal dispute, a financial document -- bring in a professional forensic examiner rather than relying on a self-serve check.
Frequently asked questions
Can PDF metadata be faked?
Yes -- metadata fields can be edited or stripped by anyone with the right tool, so treat what you find as an investigative lead, not absolute proof.
Does removing metadata hide tampering?
Not entirely. A document that's had its history scrubbed often looks suspicious in its own right -- missing fields where you'd expect them, or a revision count that doesn't match how the file was described to you.
Is a metadata check legally admissible evidence?
No -- this isn't legal advice, and a quick check like this is a first-pass screening step, not a certified forensic report. For anything with real legal stakes, involve a professional forensic examiner.
Does PDF inFOOT upload or change my file?
No. It reads the file locally in your browser to produce its report and never modifies the original.
What if a PDF has no metadata at all?
Some tools strip metadata intentionally for privacy, so an empty field on its own isn't automatically suspicious -- it's one signal to weigh alongside everything else, not a verdict by itself.