What PDF metadata tells you about a file's history
Updated July 22, 2026
Every PDF carries a small block of information about itself: who or what made it, when, and how it's been handled since. This sits apart from whatever text or images show up on the page, so you won't see it just by reading the document. Right click the file in Windows or macOS, or open its properties panel in a PDF reader, and most of it is visible in under a minute.
For a landlord reading a pay stub, an employer checking a reference letter, or a buyer looking at a signed contract, that metadata can be genuinely useful. It just isn't a verdict. A date or a software name can point you toward a question worth asking; it can't answer the question by itself, and treating it like it can is how people end up accusing someone of forgery over a routine re-save.
Created and modified: two different clocks
Inside the file, a PDF stores a CreationDate and a ModDate, each stamped by whatever software wrote them, in a format that looks like D:20260304153000-05'00' (year, month, day, time, then a timezone offset). The creation date is set once, when the PDF itself was generated. It is not the date someone started drafting the underlying document; it's the date the export or print-to-PDF step actually ran. Someone can spend three weeks writing a lease in a word processor and the resulting PDF's creation date will still just be the moment they hit "save as PDF."
The modified date updates every time a program saves the file again, and "again" includes things that have nothing to do with faking content: opening it in a reader that auto-repairs a damaged file, adding a digital signature, filling in a form field, or running it through a compression tool. A modified date three months after the creation date tells you the file was touched. It doesn't tell you what was touched, or by whom, or whether anything on the page actually changed.
One more wrinkle worth knowing: the dates your operating system shows you are usually not these internal dates at all. Windows Explorer's "Date created" and macOS Finder's "Date created" refer to when that copy landed on your hard drive, which is the day you downloaded the email attachment or copied the file from a USB stick. That's a completely different number from the PDF's internal CreationDate, and mixing the two up is one of the most common ways people misread a file's age.
Producer and Creator: the software fingerprint
Two more fields, Creator and Producer, record what made the file. Creator is usually the originating application, like "Microsoft Word" or "Google Docs." Producer is the specific engine that converted that content into the PDF format, and it's often more revealing because it's harder to fake by accident: strings like "Adobe PDF Library," "Skia/PDF" (Chrome's print-to-PDF path), or "Quartz PDFContext" (an export from macOS Preview) each point to a specific pipeline.
None of these strings are inherently suspicious on their own. A huge share of ordinary business PDFs pass through Microsoft Word, Google Docs, or a browser's print dialog, and all of those leave perfectly mundane Producer strings. What's worth a second look is a mismatch between the document's supposed origin and its stated software: a bank statement or official letter that names a general-purpose photo editor or a PDF editing tool as its Producer, when a bank's actual statement system would use a dedicated internal generator, is at least worth asking a follow-up question about. A generic Word or browser export naming a scanned invoice, by contrast, is completely normal.
Why an edited PDF can still contain the original inside it
The PDF format was built to let programs save changes without rewriting the whole file. Instead of replacing the document, an editor appends the changed data at the end, together with a "cross-reference" pointer telling the reader to use this new chunk first, then fall back to the old one underneath it for anything not included in the new chunk. That's called an incremental update, and it's how a lot of routine edits, like e-signatures and form fills, get saved.
The practical effect is that a PDF which has been edited this way is not really one document. It's a stack: the original file, plus one or more layers of changes, glued together in order. Open the file today and you see the final layer. But the bytes for the earlier version, sometimes including an entire earlier draft with different numbers or wording, are often still sitting inside the same file, just no longer the "current" one a normal PDF reader shows you.
This is different from what happens when someone runs a document through a full re-save, a "flattening," or a scan. Those processes rebuild the file as a single clean version with no earlier layers left inside, and there's no format-level way to tell that apart from a file that was genuinely never touched. If you want to check whether a specific file you have is carrying earlier versions inside it, that's the exact question PDF Edit Checker answers: it looks for those extra layers and, when it finds one, rebuilds it so you can compare it against the current version.
What metadata can't prove
It's worth being blunt about the limits here, because overselling what a date or a software string means is how honest documents get treated like evidence of fraud. A modified date after the creation date means the file was saved again. It does not mean anyone altered the numbers on the page, added a fraudulent line item, or did anything wrong. Plenty of completely legitimate paperwork gets modified after it's created: e-signed, watermarked, compressed for email, or run through a scanner's cleanup pass.
A blank or missing field means nothing by itself either. Many export tools simply don't write a Creator or Producer string, some strip metadata on purpose for file-size or privacy reasons, and older documents from tools that have since been discontinued can have gaps that are just an artifact of software history. Absence of a field is not evidence of concealment.
And all of it can be changed.
Metadata is just a small set of key-value pairs sitting near the end of the file, editable with tools built for exactly that purpose, no special skill required. Someone who wants to hide that a file was recently modified can rewrite the dates or wipe the Producer string in a few clicks. That means metadata is good for confirming a story that checks out and for raising a flag on an inconsistent one, but a completely clean-looking metadata block is not proof that a document is authentic. It just means nobody left an obvious trace, or there was never a trace to leave.
Looking at these fields yourself
You don't need any special software for a first look. On Windows, right click the PDF and check its Properties dialog, which typically surfaces title, author, and a couple of dates, but usually not Producer or full history. On a Mac, open the file in Preview and look for an inspector or info panel, which gives a similar summary. Free PDF readers, including Adobe Acrobat Reader's document properties panel, usually show the complete set: both dates, Creator, Producer, and often a PDF version number.
For a lot of everyday PDFs, that quick look is genuinely enough, and skipping all of this and doing nothing is a perfectly reasonable choice for a flyer, a receipt, or anything where being wrong costs you nothing. It's when money, a signature, or a legal claim is riding on the file that the deeper questions from the sections above start to matter. If you'd rather see all of these fields laid out in one table instead of hunting through menus, and also find out whether the file has an earlier version hidden inside it, PDF Edit Checker does both in one pass, entirely in your browser. For a pay stub or bank statement specifically, where the stakes usually involve someone else's money, the Fake Document Detector adds document-specific checks on top of the metadata and edit-history picture.