Sometimes. Two checks are reliable on their own: a valid digital signature, and confirmation from whoever issued the document. Everything else is a clue. The file’s properties can name the app that last wrote it, a file saved by appending can still hold its earlier versions, and an edited line can differ in font or spacing from its neighbors. But properties are easy to change and often left alone, many files are rewritten from scratch, and a careful edit can leave no visible trace. This guide is for the person who receives a PDF and needs to trust it: what each check can show, what it cannot, and when to stop guessing and ask the issuer.
What does a digital signature prove?
That the signed bytes have not changed since signing, and who signed them, if you trust the signer’s certificate. A PDF signature covers a byte range of the file: everything except the space that holds the signature value. The PDF standard says a viewer recomputes the digest of those bytes, and “Differences in the digest values indicate that modifications have been made since the document was signed.”
You can see the ranges with Poppler’s free pdfsig. Run on the demo signed document of PDF Textfix, a 47,570-byte file, on October 12, 2026, it printed, among other lines:
Syntax Error (0): Invalid or missing Signature string
- Signed Ranges: [0 - 44956], [47006 - 47570]
- Not total document signed
- Signature Validation: Signature has not yet been verified.The two ranges cover the whole file except the gap between byte 44,956 and byte 47,006, where the signature value sits. The other three lines are about the demo itself: its signature value is a placeholder that no certificate made, and pdfsig reports a syntax error for the signature string, does not call the document totally signed, and cannot verify the signature. In a real signature the gap holds the signer’s signed data, and pdfsig reports whether it verifies.
In Acrobat, the Signatures panel validates a signature; Adobe’s help says this lets you “verify the authenticity of the signer and the signed content.” When a file was changed after signing, Acrobat can also show the signed version next to the current one: “Select Compare Signed Version to Current Version to check for changes made after signing.”
A signature that fails is not always tampering. The certificate may not be in your trusted list, or the document may allow later changes such as form filling or another signature, which the panel lists. Read the details before concluding anything. And a missing signature proves nothing either way: many PDFs are never signed. See the digital signature entry for the terms.
What can the file’s properties tell you?
A little, and never with certainty. A PDF’s document information can hold a title, an author, the creating app, the producer and two dates. For the producer, the standard’s definition is “the name of the conforming product that converted it to PDF.” Preview’s Inspector shows these details; Apple’s guide says it covers information “such as file size, the author name, and the image resolution”. pdfinfo file.pdf prints every field. On the demo signed document it shows Producer: Quartz PDFContext and the same creation and modification time.
What the fields can suggest: a modification date long after the creation date, or a producer that does not match the issuer’s usual software. What they cannot do is prove an edit. Every field is optional, any app can set it, and many apps leave it unchanged when they save. How to view and edit PDF metadata on a Mac shows where each field lives.
Can earlier versions be inside the file?
Yes, when the file was saved by appending. The standard allows it: “When updating a PDF file incrementally, changes shall be appended to the end of the file, leaving its original contents intact.” Each such save adds a new end-of-file marker, %%EOF. More than one marker is a hint that the file was updated after it was first written, and sometimes the earlier version can be read back. It is only a hint: other structures, such as a file optimized for fast web view, can carry more than one too. See incremental update.
The reverse does not hold. Many apps write the whole file again when they save, and then no earlier version remains. One marker does not mean the file is untouched.
What visual signs suggest an edit?
Zoom in on the lines that matter, such as amounts, dates and names, and look for these:
- a word in another font, weight or size than its neighbors;
- uneven spacing around a word, or a line longer than the rest;
- characters sitting slightly above or below the baseline;
- a different shade of black, or a background that changes behind one line;
- text that cannot be selected next to text that can, or the reverse.
These are signs, not proof. Ordinary documents have quirks from their producer, and a careful edit can show none.
What does PDF Textfix write when it saves an edit?
For a recipient, the useful facts are these. Many editors, PDF Textfix among them, write the whole file again when they save, and PDF Textfix leaves the document’s properties, its dates and producer included, as they were. So a single %%EOF and unchanged dates prove nothing either way, for a file from this app or from many others. A signature is the check an edit cannot pass: before the first edit of a signed or certified file the app asks, and says that saving will make its signatures stop verifying, and once the edit is saved they no longer verify. The terms forbid using the app to make a document say something false in a way that deceives others. Is it legal to edit a PDF? covers where the lines are.
What is the reliable way to check?
Go to the source:
- Ask the issuer. Send the document back, or call the number on their website rather than the one in the PDF, and ask them to confirm the details that matter.
- Compare with the issuer’s copy. If they can send the file again, compare the two, as shown below.
- Use their verification service. Many official documents carry a reference or a code that the issuer’s own website can check.
- Rely on a valid signature from a certificate you trust, for the parts it covers.
Two copies can be compared in two ways. Identical files have the same SHA-256 checksum, shasum -a 256 file.pdf, but any re-save changes it, so a different checksum alone shows only that the bytes differ. To see which words differ, compare the text of the two files with Poppler’s pdftotext and the diff command that comes with macOS:
diff <(pdftotext -layout issued.pdf -) <(pdftotext -layout received.pdf -)In a test on October 12, 2026, on two one-page test files that differ in one amount, it printed only that line:
2c2
< Total due: EUR 1,250.00
---
> Total due: EUR 1,850.00It compares text only: a changed picture, such as a scanned page, needs a look at the pages side by side.
Questions people ask about spotting edited PDFs
Can metadata prove that a PDF was not edited?
No. The fields are optional, any app can write them, and many apps leave them as they were when saving. They can raise a question; they cannot settle one.
Does a valid signature mean the content is true?
It means the signed bytes are unchanged and that the certificate belongs to the signer. Whether the content is correct is a separate question for the signer.
Can an online tool tell whether a PDF was edited?
It can read the same things you can: the properties, the number of saved versions, the signatures. It cannot see more than the file holds, so its verdict has the same limits, and uploading the document hands it to a third party. For a document that matters, ask the issuer.
Why does my viewer say a signed PDF was changed when I only filled in a form?
Some documents allow form filling or further signatures after signing. The viewer lists those changes; read the signature details to see what was changed and whether the document allows it.