How to Check Who Created or Last Edited a PDF

When you need to verify a PDF someone sent you, rather than fix one of your own, the same hidden properties tell a different, more useful story if you know what to look for.

Fixing your own PDF’s metadata is a matter of typing the right name into the right field — see Change a PDF’s Title, Author, and Properties for that. This is the other side of the same tool: reading a PDF someone else sent you, to understand where it actually came from and whether it’s what it claims to be.

What you can actually learn from a file you didn’t create

Upload the document to View & Edit PDF Metadata and it displays the full set of stored properties: Title, Author, Subject, Keywords, Creator, Producer, PDF version, creation date, modification date, page count, and encryption status. Most of this was filled in automatically by whatever software made the file, which is exactly what makes it useful for verification — it’s information the sender likely never thought to review before sending, rather than a message crafted for you.

The Producer field: what software actually touched this file last

Producer records the specific software that generated the PDF you’re holding, not necessarily the software the original document was written in. A contract exported once from Word and never touched again typically shows a Word-related producer. A contract that shows a PDF editing tool as its producer — rather than the office software you’d expect for a document like it — is a signal worth a second look: it means something re-saved or modified the file after its original export, which isn’t necessarily suspicious, but is a fact worth knowing before you treat the document as an unaltered original.

Creation date vs. modification date: two different questions

Creation date records when the PDF was first generated. Modification date (sometimes shown as ModDate) records when it was last saved. For a document that’s genuinely never been touched since it was created, these two dates should match, or the modification date should be absent entirely.

A modification date noticeably later than the creation date means the file was opened and re-saved by something after its original creation — worth asking about directly if you’re checking a signed contract or an official document where “has this been altered since it was finalized?” actually matters. This isn’t proof of anything nefarious on its own — plenty of legitimate workflows re-save a file (adding a signature, flattening a form) — but it’s a factual data point, and one most senders never think to check before forwarding a document.

What this can’t tell you

Metadata is self-reported by whatever software produced the file — it isn’t independently verified by anything, and it can be edited directly, including by someone specifically trying to make a document look older or untouched. Treat what you find as a useful data point that’s consistent (or inconsistent) with what you’d expect, not as cryptographic proof of anything. A document that looks completely normal in its metadata can still have been carefully altered by someone who knew to also clean up after themselves; a document with a puzzling metadata trail might simply reflect an entirely ordinary editing history nobody thought twice about.

A quick verification checklist

  • Does the Producer match the type of software you’d expect for how this document claims to have been made?
  • Do the creation and modification dates line up with the story you were told about when this document was finalized?
  • Is the Author field populated, and does it match who you were told sent or wrote this?
  • Is the page count what you expected, confirming nothing was quietly added or removed compared to what you were told you’d receive?

None of these alone proves anything conclusively, but together they’re a fast, free sanity check before relying on a document that matters.

Ready? Try the free PDF Metadata tool now — no sign-up, no watermark, and your file is never stored.