Free online PDF metadata checker: Who made this PDF, and when was it changed?

How can I tell if a PDF has been edited?

Compare the created and modified dates. Dates less than 60 seconds apart count as unmodified, because many programs stamp both when saving. A gap of under five minutes usually means a minor edit or an auto-save. A bigger gap means the file was saved again later. The dates do not show what was changed.

Can PDF metadata be faked?

Yes. Every field is text that any PDF editor can change, and many conversions overwrite it without asking. When we converted our test file, both dates were reset to the moment of conversion. So a recent date tells you when that copy was written, not when the content was first drafted.

How do I find out who wrote a PDF?

Look at the Author field in the report. It usually holds the account name of whoever set up the software, and it is copied forward when someone reuses a template. So it may name a colleague, a company or nobody at all. It cannot prove who wrote the document.

Two places a PDF stores its properties

A PDF can describe itself twice. The older Info dictionary holds short keys such as Title, Author, Creator, Producer, CreationDate and ModDate. The newer XMP packet is a block of XML embedded in the file, with properties such as dc:title, xmp:CreateDate and pdf:Producer. Applications are supposed to keep the two in step, but editors that touch only one of them leave the file disagreeing with itself.

The checker reads the Info dictionary through pdfinfo and searches the first 2 MB of the file for an XMP packet. When both hold a value, the report picks one according to the table below. A field missing from the chosen source falls back to the other, so a title can come from the Info dictionary while the dates come from XMP.

Which source each report field uses first

Decoding a PDF date string

Info dictionary dates use the pattern D:YYYYMMDDHHmmSSOHH'mm': a D: prefix, the year, month, day, hour, minute and second, then the offset from UTC. O is +, - or Z, and the apostrophes separate offset hours from minutes. Everything after the year is optional, so D:2026031514 is a valid date that stops at the hour; the checker fills the missing minutes and seconds with zeros. XMP dates use ISO 8601 instead, such as 2026-02-14T16:45:10+02:00.

A measured report from a test file

We built a one-page file whose Info dictionary held a title, an author, Creator and Producer both set to Microsoft® Word for Microsoft 365, a creation date of D:20260315143022+01'00' and a modification date of D:20260317091544+01'00'. These are the pdfinfo lines the checker parsed, followed by what the report made of them.

Creator and producer are different things

Creator names the application the document was written in. Producer names the component that wrote the PDF bytes, which is often a separate library or print driver. A report drafted in Word and saved through a virtual printer can show Word as Creator and the printer driver as Producer. When both are empty, the file was either produced by a tool that leaves them out or had its metadata removed.

The checker matches both strings against its catalogue of known applications and reports the most specific match. Names are matched as whole words after trademark signs are removed, so our Microsoft® Word test string is reported as Microsoft Word, while a name such as ExampleWriter is not mistaken for LibreOffice Writer. Names it does not recognise are still shown, labelled uncategorized. A version number inside either string is extracted separately, so LibreOffice 24.2 is listed as LibreOffice with version 24.2.

Date notes and what triggers them

• Created and modified less than 60 seconds apart count as unmodified, because many programs stamp both when saving.
• A gap of under five minutes adds the note that edits were probably minor or an auto-save.
• A modification date earlier than the creation date is flagged as a possible clock or metadata problem. Our test file with created 10 June and modified 1 June 2026 showed this note, and its date reliability dropped from high to medium.
• No modification date at all produces the note that the document may not have been edited after creation. Many generators simply never write one.
• Date reliability starts at 100 and loses 30 points for a missing creation date, 20 for one that cannot be parsed and 40 for the reversed-dates anomaly. 80 or more is high, 50 to 79 medium, lower is low.

What these fields cannot establish

Every field above is text that any PDF editor can change, and many conversion steps overwrite it without asking. When we passed our Word-labelled test file through Ghostscript, the title, author and Creator survived, but the Producer became GPL Ghostscript 10.08.0 and both dates were reset to the moment of conversion. A recent creation date therefore says when that copy was written, not when the content was first drafted.

Metadata also cannot identify a person. The Author field usually holds the account name of whoever set up the software, and it is copied forward when a template is reused. Treat a mismatch between fields as a reason to look closer, and a clean report as the absence of obvious inconsistencies rather than proof of authenticity.