Check if a PDF was edited or tampered with
A PDF can look untouched and still carry the fingerprints of every edit it has been through. When someone changes a document and saves it, older data is often left physically inside the file — a normal reader just never shows it.
metavanish reads the file byte by byte and surfaces those traces: extra revisions, metadata that was overwritten, and marks left by editing tools. Everything runs in your browser session and nothing is uploaded or stored.
Open the free tool →What tampering actually looks like inside a PDF
PDFs are usually saved incrementally: each edit is appended to the end of the file instead of rewriting it. That means the previous version is still there, underneath the current one. A few signals give it away:
- Multiple revisions — the file was saved more than once (several %%EOF markers), so an earlier state still exists in the bytes.
- Superseded metadata — an old /Info dictionary or XMP packet that a normal reader hides but that still holds the original title, author or dates.
- A changed /ID — the second half of the trailer /ID changed between revisions while the first stayed the same: the classic signature of an incremental edit.
- Tool traces — markers like %EndExifToolUpdate or an ExifTool toolkit string, showing the file was processed by a metadata editor.
How to check a PDF for edits
You do not need to install anything or send the file anywhere. The forensic check is read-only — it never changes the document.
What the signals mean
A single revision is completely normal — most PDFs are saved once. The point of interest is a mismatch: an empty or generic title in the current version while an earlier, overwritten revision still holds the real one; a document that claims one authoring tool while ExifTool traces say otherwise; or several XMP packets with a copied DocumentID.
None of these prove intent on their own, but together they tell you a file is not what a plain reader makes it look like — which is exactly what you want to know before trusting or forwarding it.
Private by design
The file is processed in the memory of your request and discarded immediately — never written to disk, never stored, no account needed. If you then want to strip that hidden history before sharing, metavanish rebuilds the PDF into a single clean revision on save.
How to use it
- Open metavanish and drop your PDF into the page (or try the built-in sample).
- Open the Forensics section — it scans the raw bytes and lists every revision, trailer and metadata block.
- Read the signals: incremental revisions, superseded metadata, tool traces and /ID changes are flagged with plain-language explanations.
FAQ
Can you always tell if a PDF was edited?
Not always — if a file was fully rewritten into a single revision, older states are gone. But most editors save incrementally, leaving revisions and metadata behind that the forensic scan can surface.
Do you upload my file?
No. The PDF is processed in your session and discarded immediately. Nothing is written to disk or stored, and no account is needed.
Does checking change the document?
No. The forensic scan is strictly read-only. Your file is not modified in any way by the check.