BASALT · JOURNAL
How to tell if a PDF has been edited, and what the file can't prove
You can tell some things about whether a PDF has been edited, but nothing inside it can prove it wasn't. A valid digital signature is the one thing that can show a file hasn't changed, and only since the moment it was signed. Everything else is a hint: the stored dates, the Producer, an extra end-of-file marker, an XMP history. Each can point to editing, and each can be missing or rewritten in a file that was edited.
So the useful question is what the file can show and what it can't. A file with no signs is only a file with no signs, and for a document that matters, such as a bank statement or an ID, the check that counts is asking whoever issued it.
The evidence, from weakest to strongest
Dates and Producer. The file stores a creation date and a modification date, and names the software that wrote it in /Producer. A modification date later than the creation date suggests a re-save. But any program that saves the file writes these, and some rewrite them: on macOS 15, a PDF re-saved through PDFKit came back with today's date as its creation date, a new Producer and a new modification date. Dates can also simply be wrong, because the clock on the computer that saved the file was. Treat both as hints. When a PDF was created separates the three sets of dates a file has.
XMP history. If the application that saved the file recorded events, the XMP packet may list actions with software names and times. Many files have none. The packet's own dates are worth comparing with the information dictionary's: on macOS 15, a PDFKit re-save rewrote /CreationDate but left xmp:CreateDate as it was. What XMP metadata is shows how to read it.
Saved generations. A program can save a change by appending it to the end of the file, with a new cross-reference section and a trailer whose /Prev entry points back to the old one. The old bytes stay. Each save ends with a %%EOF marker, so two or more markers can mean the file was saved incrementally. Incremental saves and what they keep covers the mechanism.
This is evidence with three caveats. A linearized file, the "fast web view" layout, has two %%EOF markers by design with no edits at all. A signed file usually has an extra marker too, because signing is itself an incremental save. And the count only shows incremental saving. A program that rewrites the whole file leaves one marker, so a heavily edited file can have one.
Content oddities. Mismatched fonts in one line, text that doesn't line up with its neighbors, or a block of a different resolution can show a spot was replaced. A careful edit leaves none of these, so a clean-looking page proves nothing.
A valid digital signature. A signature covers a defined range of the file's bytes. If anything in that range changes, the signature fails. The signature is the only check that supports "this hasn't changed since it was signed", and it says nothing about what happened before signing. A signature is usually added with an incremental save, and later changes can be appended the same way, so a signed file can also have changes after the signed range. How to verify a PDF signature covers reading the result.
How to look on a Mac
Start with Preview. Choose Tools > Show Inspector and read General Info: Creation date, Modification date, Content creator and PDF Producer. A modification date well after creation, or a Producer that names an editing tool, is a reason to look closer. The Annotations pane lists any comments with their author and date.
Count the saved generations next. In Terminal:
grep -a -c '%%EOF' document.pdfA result of 1 means one end-of-file marker. Use -a, because on macOS plain grep treats a PDF as binary and prints nothing. To see where each marker sits:
grep -abo '%%EOF' document.pdfEach line is a byte offset and the marker. If two markers appear, check whether the file is linearized before drawing a conclusion. Install qpdf with brew install qpdf; it only reads here.
qpdf --check document.pdfAmong its lines is "File is linearized" if it is. To see the update chain, print the trailer:
qpdf --show-object=trailer document.pdfA /Prev entry means a later cross-reference section points back to an earlier one, which is how incremental saves are linked. In a test file with one incremental save, the trailer showed /Prev 545, and the earlier trailer had none. A linearized file shows /Prev too, with no edits, because its two sections are linked the same way, so read this together with the linearization line.
To see what an earlier generation held, work on a copy. Add 5 to the offset of the first marker, then keep that many bytes:
head -c 759 document.pdf > earlier.pdfIn the test file, the marker was at offset 754, so 759 bytes made a valid PDF that still showed the original page text, while the full file showed the edited text. Check the copy with qpdf --check earlier.pdf. It works only when the file was saved incrementally. In a linearized file the first marker closes the first-page section, and a copy cut there is just a broken file. The head command only reads the original. Keep the copy where you won't mistake it for the real document.
To compare the earlier copy with the current file:
shasum -a 256 document.pdf earlier.pdfDifferent digests mean different bytes. They don't say which differences are content: on macOS 15, two files written from the same content one second apart also differed, by a few dozen bytes in the dates and /ID. Checking whether two PDFs are identical goes through that.
What a clean result means
Suppose all the checks above come back quiet: dates match, one marker, no history. That tells you nothing about editing. A PDF can be rebuilt from scratch, exported from a different program or printed to a new file, and every one of those starts a fresh set of dates, one generation and no signature. Metadata can be written by hand. And a re-save through some software clears most of the traces that are there: on macOS 15, a file re-saved through PDFKit came out with a new Producer, new dates and one marker.
So absence of signs is not evidence of an unedited file. Reasoning in the other direction is safer: the signs you find can support a suspicion, but you need the source to settle it.
The check that settles it
Ask the issuer. For a bank statement, ask the bank for a copy or check the transaction in your online account. For a contract, ask the other party for the file they hold and compare the two. For an ID or certificate, use the issuing body's verification service if it has one, or contact it directly. A signed PDF is checked against the signer's certificate, which is why signature validity depends on whether you trust who signed.
If you hold both a known original and a suspect copy, compare their text. Comparing two PDFs shows how.
Frequently asked questions
How do I check if a PDF has been altered?
Look at the Modification date and Producer in Preview's Inspector, count %%EOF markers with grep -a -c '%%EOF' document.pdf, and check for a digital signature. Each result is a hint at best. Only a valid signature shows the file is unchanged, and only since it was signed. For documents that matter, verify with the issuer.
How do I check if a PDF has been modified?
Compare the creation and modification dates in Preview's Inspector. A later modification date suggests a re-save. Then count end-of-file markers: more than one can mean incremental saves, unless the file is linearized. Neither proves anything alone, because programs rewrite dates and many saves leave one marker.
How do I check the authenticity of a PDF file?
Check for a valid digital signature from a signer you trust, and verify the content with whoever issued it. Metadata can't establish authenticity, since it's editable text in the file. A signature shows who signed and whether the signed bytes changed. It doesn't show the content was true.
Can you tell if a PDF has been edited?
Sometimes. Signs include a modification date after the creation date, an editing tool in Producer, several saved generations, or an XMP history. Many edits leave none of these, so a file with no signs can still have been edited. The signs are one-way evidence.
Does a later modification date mean the PDF was edited?
Not necessarily. It means some program saved the file after it was created, which includes harmless re-saves, conversions and compression. Equally, an edited file can show matching dates because the program that saved it rewrote them. Use the date as a prompt to look further.
Why does my PDF have two %%EOF markers?
Either it was saved incrementally, with changes appended after the original ending, or it's linearized for fast web viewing, which uses two markers with no edits. Signing a file also appends a section, so a signed file has an extra marker. Run qpdf --check and look for "File is linearized" before concluding anything.
Can I see what the PDF looked like before it was edited?
Only if it was saved incrementally. Copy the first bytes of the file up to an earlier marker, as shown above, and open the copy. A file that was rewritten in full has no earlier version inside it. Time Machine or the app's Versions menu may have an earlier copy of the file itself.
Doing it in Basalt
Basalt has an Inspect tool that reports how many saved generations a PDF has, which document properties are filled and whether XMP is embedded, and it records the file's SHA-256 digest so a report is tied to one exact file. It counts end-of-file markers, so a linearized file with no edits also shows two generations: the count is a reason to look, not a verdict. Inspect doesn't verify digital signatures.
Basalt's Compare tool is useful when you have a known original. It compares the text of two PDFs page by page and reports added, removed and changed lines, with a blackline export of struck-through removals and underlined additions. It isn't a layout or visual comparison. Every tool writes a new file, and the original is never modified. Basalt is a one-time $29 for up to three Macs, and you can try every tool for 24 hours first.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.
