Under the standard, the added cross-reference section “shall contain entries only for objects that have been changed, replaced, or deleted”; the added trailer points back to the previous one with a Prev entry; and “Each trailer shall be terminated by its own end-of-file (%%EOF) marker.” Nothing before the old end of the file is rewritten, so the file grows with every such save.

Why do PDF apps save incrementally?

Speed, first: in the standard’s words, “small changes to a large document can be saved quickly,” because nothing already in the file is written again. Signatures, second: a digital signature covers a range of the file’s bytes, and when a signed document is saved by appending, “the data corresponding to the byte range of the original signature is preserved.” That is how a second digital signature can be added without breaking the first.

What does an appended update look like?

On the demo invoice made for PDF Textfix’s screenshots, a short script of ours appended an update as an appending editor would: a new copy of the page’s content stream with the date “2026-02-28” in place of “2026-02-30”, a cross-reference section and a trailer. qpdf only read the page and checked the result. The appended part ends:

trailer
<< /Size 20 /Root 1 0 R /Info 2 0 R /ID […] /Prev 63053 >>
startxref
64856
%%EOF

/Prev gives the byte position of the original file’s cross-reference section, 63053. A reader starts from the last startxref, so it uses the new stream and follows /Prev back for everything else.

Why does an incremental update matter for privacy?

The appended invoice opens with the new date, yet its first 63626 bytes, up to the first %%EOF and its line break, are the original file, byte for byte: head -c 63626 incremental.pdf > earlier.pdf gives it back, old date included. Anyone who receives the edited file receives the original too. The step-by-step check for any file is in what saving does to your PDF.

How can you tell if a PDF has incremental updates?

Count the end-of-file markers with grep -c -a '%%EOF' file.pdf; the appended invoice has 2. More than one usually means appended updates. The exception is a linearized PDF, which may end its first-page section with a marker too: the copy of the demo letter that qpdf linearized counts two, so run qpdf --check-linearization (from brew install qpdf) before concluding. One marker proves only that the file was last written whole, not that it was never edited; the guide on whether a PDF has been edited covers other signs.

What does PDF Textfix’s Save do instead?

It writes the whole file again as one revision. The lines you replaced are removed from the pages, and the saved file keeps no earlier version of them. Everything you did not edit is copied as it was, unless the file was damaged; PDF Textfix tells you when it repaired one. So the same words can remain in bookmarks, links, comments, metadata or a tagged file’s accessibility text, and fonts keep the shapes of their characters: PDF Textfix is not a redaction tool. See redacting versus deleting text and what a saved file still holds.

Saving with no edit writes the file back exactly as it was read, earlier revisions included. After an edit the original cannot be recovered from the saved file, so use Save As (⇧⌘S) to keep it. Signatures no longer verify after a rewrite, which is why PDF Textfix asks before your first edit of a signed file.

What can you do about earlier revisions?

To share a file without them, write it again whole: qpdf in.pdf out.pdf does, since “any object that is not referenced in a traversal of the document from the trailer dictionary will be discarded.” It breaks signatures.

Questions about incremental updates

Does every save make the PDF bigger?

With incremental saves, yes: one changed date added 1,418 bytes to the demo invoice. The guide to large PDFs covers other causes.

Can an incremental update be undone?

Yes. Cut the file just after an earlier %%EOF and its line break, as above; what remains is the earlier file, complete.

Is this the same as the versions macOS keeps of a file?

No. Those are copies kept outside the PDF; see previous versions of a PDF on a Mac.