What can the PDF itself tell you?
Document properties in any PDF reader show a created date, a modified date and the application that made the file. Software writes those fields, and anyone with a PDF editor can change them. An innocent re-save or export changes them too. Treat them as a clue.
If the PDF carries a digital signature, the reader’s signature panel reports whether the document changed after that signature was applied. That is a separate question from whether the reader trusts the certificate: here is why Adobe says “signature validity is unknown”. To see each signature’s certificate and whether the signed part has changed, check its signatures, free on every plan.
The file alone only takes you so far. Here is what each way of checking can show.
| Where you look | What it shows | How far it goes |
|---|---|---|
| Document properties | Created and modified dates, the author and the application that made the file. | A clue. Anyone with a PDF editor can change them. |
| A digital signature | Whether the signed part changed after each signature was applied. | Only the signed part, and only for a signed PDF. |
| A fingerprint the sender kept | Whether your file and theirs are byte-for-byte the same. | Only if the record was made when the file was finished. |
| A KuduDoc seal | Whether the file is unchanged since sealing, on the free checker. | A fact about the bytes, not about what the document says. |
Compare it with a record made when it was finished
A fingerprint is a short code calculated from every byte of a file. With SHA-256, the method published by the US National Institute of Standards and Technology in FIPS 180-4, a single changed byte gives a completely different result.
If the sender recorded the fingerprint when the file was finished, or kept the file itself, compare yours with theirs. Matching fingerprints mean the two files are byte-for-byte the same.
The record has to exist before the question does: a fingerprint made today tells you nothing about last month. For the questions that come later, timestamp a file’s fingerprint today.
The ECT Act weighs an electronic record partly by how reliably its integrity was kept (s15).
Ask the sender for the sealed original
If the document came from someone who sealed it, ask for the sealed PDF itself — not a re-saved, re-exported or scanned copy. Printing, scanning or exporting makes a new file with a new fingerprint.
What if the PDF was sealed with KuduDoc?
- Open KuduDoc’s free checker. It is free and needs no account.
- Drop the PDF you received: the file itself, not a screenshot or a fresh export. Your device calculates its SHA-256 fingerprint and sends only that. The fingerprint, the time, your IP address and your browser are logged.
- Read the three lines: file comparison, record source and timestamp. There is no overall pass or fail.
| Result | What it means | What it does not tell you |
|---|---|---|
| Unchanged since sealing | The bytes match a seal made from a KuduDoc account. | Whether what the document says is true, who signed it, or who owns anything. |
| Unchanged since stamping | The file matches a stamp made with the free seal tool, not an account seal. | Who stamped it. |
| No matching record | No record matches this exact file. | Whether it was altered: the checker cannot tell a never-sealed file from an altered one. |
Your result A copy printed to PDF
File comparisonNo matching record
Record sourceNo matching entry
TimestampNo matching record
The checker cannot tell a never-sealed file from an altered one. No match does not establish tampering.
Your result The sealed PDF
File comparisonUnchanged since sealing
Record sourceAccount seal
TimestampConfirmed
We confirm the date of sealing and that this file is unchanged since. We cannot confirm what the document says is true.
More on how to read a check result.
What can’t a check tell you?
- No match is not proof of tampering. A file that was never sealed has no record either.
- A changed file is not proof of tampering either. An intended edit, a redaction or a fresh export changes the bytes too.
- A match is about the bytes, not the contents. KuduDoc cannot say whether a document is genuine or whether what it says is true. For that, read how to tell if a document is fake, and who can confirm it.
- An edited copy starts again. An edited or redacted copy is a new file with its own fingerprint. It cannot inherit the source record’s unchanged since sealing result.
Next time, seal it before you send it
Seal the finished PDF before it leaves you, so anyone can check a copy later, free and without an account (what a seal records). Personal is free.
Questions people ask
Can you tell if a PDF has been edited?
Not reliably from the file alone. Its dates and author fields can be rewritten, and an innocent re-save changes them too. Compare it with a record made when the file was finished, such as a fingerprint, or ask the sender for the original.
Do the dates in a PDF’s properties show when it was changed?
They show what the software that last saved the file wrote. Anyone with a PDF editor can change them, so treat them as a clue, not as evidence.
Is there a free online checker for any PDF?
For a signed PDF, yes. KuduDoc’s PDF signature checker is free on every plan, with a KuduDoc account, and says whether the signed part has changed since each signature. For an unsigned PDF, a checker can only compare it with a record made earlier, such as a KuduDoc seal.
Does “No matching record” mean the PDF was forged?
No. The checker cannot tell a never-sealed file from an altered one. No match does not establish tampering. Ask the sender for the sealed PDF itself.
Does a changed file mean someone tampered with it?
Not necessarily. An intended edit, a redaction or a fresh export changes the bytes too. The fingerprint tells you the files differ, not why.
Can KuduDoc tell me whether a document is genuine?
No. A match means unchanged since sealing — a fact about the file's bytes, not about what the document says, who signed it or who owns anything.
Sources
- FIPS 180-4, National Institute of Standards and Technologycsrc.nist.govSHA-256: one changed byte gives a different fingerprint.
- Electronic Communications and Transactions Act 25 of 2002gov.zaSections 14 and 15: an original record, and how the integrity of an electronic record is weighed.
- Validating digital signatures, Adobe Acrobat Helphelpx.adobe.comA signed PDF’s signature panel reports changes after signing apart from certificate trust.
Last checked