Online PDF Editor Traces: What an Edited File Reveals

An online PDF editor almost always rewrites the whole file rather than patching it, and that rewrite leaves traces: a changed producer string, a new modification date, a regenerated file identifier, re-embedded fonts and, if the original was signed, a broken or missing signature. None of these proves fraud. Together they show that a document was processed by a web tool after the issuer produced it, which is exactly what a reviewer needs to know before relying on it.

This article is for the person who receives the file: a KYC analyst, a lettings agent, an underwriter, an HR administrator. It explains what web-based editors typically change, where to see it, and why the absence of traces proves nothing.

Why web editors leave different traces from desktop software

Browser-based editors usually regenerate the document on a server, so the output is a new file, not a modified copy. The PDF format, specified in ISO 32000-2, allows two ways to change a file: append an incremental update after the original end-of-file marker, or write a complete new file. Desktop tools often append; many web services rewrite from scratch, merge, compress and re-save in one pass.

That has a practical consequence. The old forensic habit of counting %%EOF markers to find revisions works well on files saved incrementally and poorly on files that went through a web service. A single revision does not mean "untouched".

The seven traces to look for

The most reliable traces sit in the producer fields, the file identifier, the font list, the object structure and the signature state. Check them in this order.

1. The Producer and Creator fields

The Producer field records the software that wrote the final file; Creator records the application that made the source. A bank statement exported from an online banking portal normally names the bank's reporting engine. If the same statement names a general-purpose web editor or an unrelated PDF library, the file has been through a second tool. Run exiftool -a -G1 file.pdf or open Document Properties (Ctrl+D in Acrobat Reader).

Build your own reference list. Take a genuine document from each issuer you see often, record its producer string, and compare incoming files against it. Do not rely on a published list of "bad" strings: services change their libraries, and the PDF Association notes that the Producer key is deprecated in ISO 32000-2 and metadata is optional and easily edited (PDF Association presentation on PDF forensics and metadata).

2. Creation and modification dates

A ModDate hours or days after CreationDate means a re-save. A ModDate later than the date printed on the document, such as a payslip for September modified in October, is worth a question. Equal timestamps are common for files produced in one pass and are not reassuring on their own.

3. The file identifier and XMP IDs

Every PDF trailer can carry an /ID array with two strings: the first is set when the file is created, the second changes when it is saved. XMP metadata adds DocumentID and InstanceID. When a rewrite regenerates both, you lose the link to the issuer's original, which can only be compared if you hold a known-good copy.

4. Fonts and text objects

Edited text often uses a different font subset from the text around it. Embedded subsets carry a six-letter prefix (for example ABCDEF+Arial). A page that mixes two subsets of the same typeface, or a figure rendered in a fallback font, is a classic sign that a value was replaced. Our guide to font forensics on forged documents shows examples. In a viewer, select the suspicious figure: edited text frequently sits in its own text block with different spacing.

5. Overlays, white boxes and flattened annotations

Some web tools do not edit the underlying text. They draw a white rectangle over the old value and place new text on top, or "flatten" annotations into the page. Copy all text into a plain text editor: hidden original values, text outside the page area and duplicated numbers show up. See hidden text layers in PDF fraud.

6. Digital signature state

A PDF signed by the issuer carries a cryptographic signature over a defined byte range. Any change breaks validation, and a full rewrite by a web editor commonly drops the signature field altogether. A document presented as "the signed original" that has no signature, or shows a broken one, deserves the issuer's original.

7. Compression, resolution and watermarks

Free tiers of some services add a watermark or footer, and compression steps lower image resolution or change the colour space. A logo that is sharp in a genuine copy and soft in the received file shows a re-encode. Treat this as supporting evidence only: applicants also compress files to meet upload limits.

What these traces cannot tell you

Traces show that a file was processed; they do not show why, and they can be removed. Metadata can be rewritten with free tools, and a TrueScreen guide describes online tools that let a user overwrite the producer, title and dates directly (TrueScreen on editing PDF metadata). Printing to PDF or rasterising a page and re-wrapping it as PDF removes most structural clues. Research on identifying the producing tool from internal coding style, rather than from metadata, exists precisely because metadata is unreliable (Robust PDF Files Forensics Using Coding Style).

Three outcomes are realistic:

• Clear traces: an unexpected producer plus a changed identifier and a mismatched font. Ask for the original from the issuer.
• Ambiguous traces: a rewritten but otherwise clean file. Many honest applicants merge, compress or rotate pages. Ask why.
• No traces: continue with cross-document checks, because a careful forger leaves nothing in the file.

What reviewers actually ask

Reviewers on compliance and property forums keep returning to the same questions. Two come up most.

"My client says they only compressed the PDF. Is that believable?"

It can be. Compression or merging changes the producer, the identifier and often the revision count, but it should not change fonts inside the text, move figures or alter values. If the only differences are producer, dates and image quality, and the content reconciles with other documents, treat it as a benign re-save and note it on the file.

"Is it safe to run a suspicious document through a free online checker?"

Not without thought. The file contains personal data, and sending it to a third-party service makes that service a processor or recipient under data protection law. In the UK, the Information Commissioner's Office expects a written contract and a lawful basis before sharing; the same logic applies under the EU GDPR. Use local tools for metadata, and an external service only under a data processing agreement.

A short procedure you can adopt

1. Record the producer, creator, dates and identifier of every incoming PDF in the case file.
2. Compare them with a genuine reference from the same issuer.
3. Select and copy the key figures (name, amount, date, account number) and check font and text-block consistency.
4. Confirm signature status where the issuer normally signs.
5. Reconcile the figures with other documents in the file: a payslip against a bank statement, a statement against a tax notice.
6. Escalate mismatches to the person responsible for financial crime reporting.

The cross-document step matters most. The broader document verification guide covers how the checks fit together, and our walkthrough on how to tell if a PDF has been edited goes deeper on revision structure, while PDF metadata tampering covers how scrubbing itself leaves a signature.

Legal and regulatory context in the UK

Presenting an altered document as genuine can be a criminal offence, and regulated firms must be able to show they took reasonable steps to verify what they relied on. In England and Wales, section 1 of the Forgery and Counterfeiting Act 1981 covers making a false instrument intending it to be accepted as genuine. For firms under the Money Laundering Regulations 2017, the FCA supervises how customer due diligence evidence is gathered and assessed. A file with unexplained edit traces that was accepted without follow-up is hard to defend; a file where the reviewer recorded the traces, asked for the original and documented the outcome is not.

Reviewers do not decide on suspicion of an offence. The firm's nominated officer does, and the front line records what it saw and passes it on.

Doing this at volume

Manual inspection takes minutes per file and depends on who is looking. Automated checks apply the same property, structure and consistency tests to every upload and route only unusual files to a person. CheckFile's AI-generation and tampering signals are a complement to your existing controls, not a replacement for reviewer judgement. For file-level completeness and cross-document comparison of fields and dates, see the KYC and banking solution, the security page for how files are handled, and the pricing page for plans.

Frequently Asked Questions

Do online PDF editors leave traces?

Yes. Most change the producer or creator field, update the modification date, regenerate the file identifier and rewrite the object structure. Some also re-embed fonts or remove digital signatures. The traces can be stripped afterwards, so their absence is not proof of an unedited file.

Can you tell which online editor was used?

Sometimes. The producer string often names the service or its library, and coding style can hint at the tool. It is a lead, not a certainty, because producer values can be overwritten and services change their software.

Does a single revision mean the PDF was not edited?

No. Many web editors rewrite the whole file, which resets the revision count to one. A single revision with an unexpected producer and a new identifier is more informative than the revision count.

Is a PDF with no metadata suspicious?

It is a flag, not a verdict. Privacy tools and print-to-PDF workflows remove metadata, and so do some portals. Ask for the original from the issuer and compare with a known genuine document.

Can I check a customer's PDF in a free online tool?

Only if you have a lawful basis and a data processing agreement with the provider. Otherwise use local tools, because the document contains personal data.

For where this fits in the CheckFile offering, see our AI and deepfake detection approach.