You can often spot signs that a PDF was edited: a Modified date later than the Created date, a Producer field naming a PDF editor, one line in a slightly different font, or text you can select that is hidden under a box. Anyone can check these in a few minutes with an ordinary PDF reader.

The honest limit: none of these signs is proof. A carefully edited file can look clean, and an untouched one can look suspicious just because it was re-saved. Only two things can actually confirm a document is genuine: a valid digital signature, or checking with whoever issued it. Everything else is a clue.

Step 1: read the document properties

Most PDF readers show the file's metadata. In Adobe Acrobat Reader it is under File, then Properties. In other readers look for Document Properties or an info button. You are looking for a few fields.

  • Created and Modified. If Modified is days or months after Created, something re-saved the file. That could be an edit, or just someone adding a comment or filling a form.
  • Producer and Creator. These name the software. A bank statement whose Producer is a consumer PDF editor, rather than the kind of system a bank would use, is worth a second look.
  • Author and Title. Sometimes these are left over from a template or an earlier document, which can tell you where the file came from.

Metadata tells you what the last program did, not who wrote the document. Here is a real example: a PDF downloaded from Kopitiam's editor shows pdf-lib (the open-source library Kopitiam uses) as its Producer, and its Created and Modified dates are both the moment you downloaded it. The original author and title are not carried over. So a fresh Created date does not mean the document is new, only that the file is.

Step 2: look closely at the text

Zoom in to 200 or 400 percent on the parts that matter: names, amounts, dates, account numbers. Edits are usually small and targeted, so that is where the tells show.

  • Font. Is one figure in a slightly different typeface, weight or size from the numbers around it? Look at shapes that vary between fonts, such as the digits 1, 4 and 7.
  • Alignment. Does a line sit a little higher or lower than its neighbours, or is the spacing between characters uneven?
  • Colour. Is the black of one word a touch different, or is there a faint box behind it on a tinted background?
  • Totals. Do the numbers still add up? On a payslip or an invoice, a changed figure often leaves the total or the tax line inconsistent.

Some readers also list the fonts the file uses. Adobe Acrobat Reader has a Fonts tab in its Properties window. If a document is set in one typeface but the list also includes a different one, such as Helvetica, ask where that font is used.

Step 3: try selecting and copying the text

This is the most useful check most people never try. Drag to select the text on a suspicious line, copy it, and paste it into a plain note.

  • If the pasted text is different from what you see, there is hidden text. A common way to change a PDF is to cover the old words with a white box and type new ones on top. The old words are often still in the file.
  • If one line will not select while the rest of the page does, that part may be an image pasted over the original.
  • If a whole page is an image while the others are text, it may have been replaced, or it may simply have been scanned separately.

Kopitiam's own Cover & replace tool works this way. It lays a matching-colour box over existing text and adds a new text box on top, and the original text stays in the file beneath. That makes it fine for fixing a typo, but wrong for hiding information. For that, Kopitiam's Redact tool turns each redacted page into an image so the text underneath is really gone. You can use PDF to Word & text to pull out every word in a file, including covered ones, and read the result. It runs in your browser, so the file is not uploaded.

Scanned PDFs are the exception. A scan is a picture of a page, so there is no text to select and no font list to compare. If a scan has been run through text recognition, the hidden text layer can contain mistakes even when nobody edited anything. For scans, the visual checks and the issuer are all you have.

Step 4: check for a digital signature

A digital signature is the one thing in the file that can genuinely detect a change. It is a cryptographic seal made with the signer's certificate. If even one character changes after signing, the check fails.

  1. Open the PDF in a reader that verifies signatures, such as Adobe Acrobat Reader.
  2. Look for a signature bar at the top or a signature panel, and open it.
  3. Read what it says: whether the signature is valid, who signed it, and whether the document has been changed since it was signed.
  4. If it reports changes after signing, read the details. Some documents allow later form filling or comments, and the panel lists what was changed.

Two things to keep straight. First, a picture of a handwritten signature is not a digital signature. Kopitiam's Sign tool, like most PDF editors, places a drawn signature as an image, and that proves nothing about whether the file was changed. Second, a valid digital signature proves the file has not changed since it was signed. It does not prove that what was written was true before that.

Incremental saves: the history hidden in some files

Some PDF software saves changes by adding them to the end of the file instead of rewriting it. The earlier version is still inside, below the changes. Specialist tools can pull those earlier versions out, and signature panels in some readers let you view the version that was signed.

There is a rough check you can do. Open a copy of the PDF in a plain text editor and search for %%EOF, which marks the end of a saved version. More than one can mean the file was saved incrementally. It is only a hint: some files have two for ordinary technical reasons, and many editors, Kopitiam's included, write a completely new file, which leaves no earlier versions behind.

Why none of this is proof

  • Metadata is easy to change or remove. Missing metadata proves nothing, and present metadata can be faked.
  • Innocent actions leave the same traces. Using Print, then Save as PDF, compressing a file, or filling in a form all change the Producer and the dates without changing the content.
  • Flattening a PDF merges added text into the page, so the select-and-copy check may no longer show a separate layer.
  • A careful forger can match fonts and rebuild a page from scratch, leaving nothing you could spot at home.

So treat what you find as a reason to ask, not a verdict. If a payslip from a tenant applicant looks off, do not accuse anyone over a font. Ask for the document again through a channel you trust, or confirm the details with the employer.

When it really matters, go to the source

For anything with money or legal weight, such as a bank statement for a loan, a payslip for a tenancy, or a certificate for a job, the reliable check is with the issuer. Ask for the document to be sent to you directly by the bank, employer or institution, or ask them to confirm the key figures. Some issuers print a reference number or QR code you can check on their official site. Type that site's address yourself rather than trusting a link printed on the document.

If a dispute may end up in court or with an insurer, keep the original file exactly as you received it and get professional help. Proper forensic examination needs specialist tools and expertise. Kopitiam is a PDF editor, not a forensic tool, and the checks in this guide are a first look, not an investigation.