PDF Modified After Signing: Check the Signature and Revision History

A PDF that was edited after signing shows up in two places: the signature panel, which reports whether the bytes covered by the signature still match, and the revision history, which lists every version appended to the file. If the panel says the document was altered since signing, the content you are reading is not what the signer approved. If it says only "changes after signing", you must open the signed revision and compare it with the current one.

This guide is written for the person who receives the file: a KYC analyst, a lettings manager, a contract administrator, an HR officer. It needs nothing beyond a free PDF reader, and it explains what each message means and what to ask the sender next. A check like this finds traces of change. It does not prove that a document is genuine.

How a digital signature protects a PDF, and where it stops

A PDF signature stores a cryptographic hash of a defined range of bytes, so any change inside that range breaks validation. The format is specified in ISO 32000-2, and the European profile for signed PDFs is PAdES (ETSI EN 319 142). The signature is a container inside the file. It lists a byte range, which covers the whole file except the space reserved for the signature value itself.

That design has a consequence people overlook. A PDF may legitimately grow after signing, because the format allows incremental updates appended after the signed bytes. A second signer adds a signature, a form field is filled in, a comment is added. The original bytes are untouched, so the first signature stays mathematically valid. Whether the update is acceptable depends on the permissions the author set.

One legal anchor helps when you explain this internally. Under Regulation (EU) 910/2014 (eIDAS), Article 26, an advanced electronic signature must be linked to the data so that any subsequent change in the data is detectable. Detection of change is the property you are relying on. It is also why an ordinary scanned or typed signature image gives you nothing to validate.

Step 1: Read the signature panel, not the badge

Open the signature panel and read the full status text, because the green tick in the toolbar summarises less than it appears to. In Adobe Acrobat Reader, choose the Signatures panel (View, Show/Hide, Navigation Panes). Each signature is listed with a status and, when later revisions exist, text such as "Revision 1 of 3". Click a signature and use the "View Signed Version" option to open the file exactly as it was when that person signed.

Write down three things for each signature:

• The signer name and the certificate issuer.
• The signing time, and whether it comes from a trusted timestamp or only from the signer's computer clock.
• The status line, word for word.

Users on forums ask the same thing again and again: "I signed a PDF and now I cannot edit it, or someone says they edited it afterwards, how do I know?" The panel answers both. If a tool forces you to remove the signature to edit the file, the original signed version is gone from the editor's point of view, so ask for the signed original, not the edited copy.

Step 2: Count revisions and extract the signed version

Each incremental save appends a new section ending in an %%EOF marker, so the marker count approximates the number of revisions. On a terminal, grep -a -c '%%EOF' file.pdf returns it. A freshly generated file often has one marker, a web-optimised file two, and a document signed once and then filled in more. Three markers on a document that only one person signed deserve a question.

To read what the file said at signing time, either use "View Signed Version" in Acrobat, or cut the file at the byte offset where the signed range ends. Tools such as qpdf and pdfsig (from Poppler) report the signed range and let you validate it from the command line. pdfsig file.pdf prints each signature, its byte range, and whether the digest matches.

Then compare the two versions visually and by text. Look for:

• Changed amounts, dates, names and account numbers.
• Pages added, removed or reordered.
• A new text block that sits above an old one (the old text is still in the file under the new layer).
• Annotations or stamps that cover original content.

If you are comparing many pages, Acrobat's Compare Files tool or diffpdf-style utilities highlight textual differences. Do this on a local copy.

Step 3: Know the attacks that keep a signature valid

Some edits leave the signature showing as valid, which is why a green status alone is not enough. Two research results are worth knowing. A 2019 study from Ruhr University Bochum on incremental saving attacks showed that several viewers displayed valid signatures on files whose visible content had been changed by an appended revision. A follow-up in 2020, "Shadow Attacks", described how an author could prepare a document with hidden content that is revealed by a permitted later update, such as filling a form field. Both are published by the research group at pdf-insecurity.org, and viewer vendors have patched many of the original findings.

The lesson for a reviewer is practical, not theoretical:

• A valid signature plus a later revision is a reason to compare, not a reason to relax.
• A signature on a document whose author allowed form filling or annotation is weaker evidence than one on a document certified with "no changes allowed".
• Open the file in a second viewer. A discrepancy between two viewers is itself a flag.

Look for the certification level too. A certifying signature carries a permission setting (no changes, form fill and signing, or annotations allowed). If the author chose "no changes" and a later revision exists, the viewer should flag it.

Step 4: Validate the signer, not only the file

A signature can be mathematically valid and still be worthless if the certificate is self-signed, expired or issued by someone nobody trusts. Check who issued the certificate. In Europe, qualified providers are listed in the EU Trusted List browser. Adobe maintains its own approved trust list, and the two overlap but are not identical, which explains many "validity unknown" messages.

For an independent opinion that does not depend on your viewer, the European Commission offers a free DSS signature validation web tool. It reports the signature level, the certificate chain, the timestamp and whether the document digest matches. Because it uploads the file, use it only with sample documents or under your data protection arrangements.

Also check the dates:

The related risk of invented certificates is covered in fake electronic signature certificates.

Step 5: Cross-check what the signed content says

Compare the figures and identifiers in the signed revision against a source the sender did not control. Even a perfect signature only proves that the signer approved those bytes. It does not prove that the amounts were true. For a signed employer letter, check the company against the official register. For a signed contract, check the party names and the company number. For a signed payslip, check the net pay against the bank credit.

Applicants have a simple question: "I signed it, why does the bank want the original from the portal?" Because the bank is validating the document's origin and consistency, not only its integrity. The guide to telling whether a PDF has been edited and the metadata tampering guide cover the file-level checks that complement this one.

What to ask the sender, and when to escalate

Ask for the original signed file straight from the signing platform or the signer, and keep the version you received. Do not reconstruct or "fix" the file yourself. A legitimate sender can almost always re-download the sealed copy or send the audit trail from the e-signature service.

• Panel says altered since signing: request the original; do not process the copy.
• Later revision exists but panel is valid: compare revisions, and ask why the update was needed.
• Validity unknown: check the certificate issuer and validate in a second tool before concluding anything.
• No signature although one was promised: ask for the signed version.

Escalate when a change coincides with a mismatch, for example an altered amount plus a revision made days after signing. Your compliance or money laundering reporting officer decides next steps; the front-line reviewer should not accuse anyone. In England and Wales, section 1 of the Forgery and Counterfeiting Act 1981 covers making a false instrument intended to be accepted as genuine, and regulation 28 of the Money Laundering Regulations 2017 requires due diligence on documents from a reliable and independent source.

For the wider process, see the document verification guide. If you receive signed files at volume, CheckFile's AI-generation and tampering signals are a complement to your existing controls, and the KYC and banking solution shows what a file check compares: fields, dates and registers. The pricing page lists plans.

Frequently Asked Questions

Can a PDF be edited after it is signed?

Yes, in two ways. Changes inside the signed byte range break the signature, which the viewer reports. Changes appended as a new revision leave the first signature valid, so you must open the signed version and compare it with the current one.

How do I see the version that was signed?

In Adobe Acrobat Reader, open the Signatures panel, right-click the signature and choose "View Signed Version". On the command line, pdfsig from Poppler lists each signature and its byte range, and qpdf can extract earlier revisions.

Why does my PDF say "validity unknown"?

Usually your viewer does not have the issuer in its trust list, or it cannot check revocation offline. It does not mean the file was changed. Validate the same file in a second tool, such as the European Commission DSS validator, before drawing a conclusion.

Does a valid signature prove the content is true?

No. It proves that the bytes have not changed since the signer applied the signature, and links them to a certificate. Whether the amounts, names and dates are accurate still needs a cross-check against registers or other documents.

Can I remove a signature and re-sign a corrected PDF?

You can, but the result is a new document with a new signature. Anyone relying on the earlier signed version should receive the original as well, so the chain of versions stays visible.

For where this fits in the CheckFile offering, see our AI and deepfake detection approach.