You cannot prove a PDF is authentic by checking one field or running one online tool. Authenticity is a relationship between the file, its claimed issuer, its delivery path, and the facts it presents. A technically clean PDF can still contain false information; a genuine PDF can contain unusual metadata after a legitimate signing or archival step.
A useful verification process combines independent checks. Start with the source, then test the exact file, its signatures, its metadata and structure, and the claims visible on the page.
Five-layer authenticity check
- Confirm where the file came from.
- Match the exact bytes against a trusted copy or checksum.
- Validate digital signatures and certificate trust.
- Review metadata and structure for inconsistencies.
- Confirm important claims with the issuer.
What “Authentic” Should Mean in Your Case
Before checking the file, define the claim you need to verify. These are different questions:
- Source: Did this file come from the named organization?
- Integrity: Are these the same bytes the organization issued?
- Identity: Does a trusted signature link the file to a verified signer?
- Content: Are the visible dates, amounts, names, and statements true?
- Legal effect: Is the document valid for a specific transaction or jurisdiction?
A PDF parser can help with integrity clues. It cannot answer all five questions.
1. Verify the Source Before the File
Prefer a document downloaded from the issuer's official, independently located website or signed-in portal. If the PDF arrived by email, inspect the actual sender domain and be cautious with forwarded messages, shortened links, and unexpected attachments.
For a high-value invoice, contract, certificate, or account statement, contact the issuer using a phone number or portal you already trust. Do not use contact details found only inside the questioned PDF.
2. Match the Exact File
If the issuer publishes a SHA-256 checksum, calculate the checksum of your file and compare it character for character. Matching checksums show that the bytes match the published reference. They do not prove the reference itself is trustworthy.
When no checksum is available, download a new copy from the trusted portal and compare it with the received file. A byte-for-byte mismatch can be legitimate—portals sometimes regenerate documents—but it gives you a concrete question to raise with the issuer.
3. Validate Digital Signatures Properly
A digital signature can bind a particular set of PDF bytes to a certificate. Adobe's validation guidance separates several checks: whether the signed content changed, whether the signer's certificate is trusted, whether the certificate was valid at signing time, and whether revocation information is available.
Use the PDF signature checker to inspect signature structures and document coverage. Complete certificate-chain validation in trusted desktop software configured with the right trust anchors for your organization or jurisdiction.
Do not rely on appearance: a pasted signature image, typed name, or “Signed” badge is not a cryptographic signature. Even a cryptographic signature is only as useful as its certificate validation and the identity checks behind that certificate.
4. Check Metadata and Structure for Consistency
Run the file through the metadata checker and PDF validator. Compare creation and modification dates, Creator and Producer values, PDF version, encryption, page count, and parser warnings with the expected workflow.
| Observation | What to ask |
|---|---|
| Producer names unexpected editing software | Was the file edited, signed, converted, or optimized after issue? |
| ModDate is later than the printed date | What operation happened at the recorded modification time? |
| Information dictionary and XMP disagree | Did different applications write separate metadata layers? |
| Parser reports damaged or recovered objects | Can the issuer supply a fresh, structurally clean copy? |
These are investigation prompts, not verdicts. Adobe documents multiple metadata mechanisms, and PDF Association notes that forensic interpretation becomes harder as files pass through different applications and revisions.
5. Verify the Visible Claims
Technical integrity does not make the content true. Confirm the invoice number, bank details, certificate ID, contract version, dates, and named parties against an independent system of record. If money or access is involved, use a second communication channel before acting.
Look for visual inconsistencies—misaligned text, different typefaces, uneven spacing, low-resolution patches—but treat them as prompts for comparison. A well-made forgery can look perfect, and a genuine scan can look messy.
Choose the Right Next Step
| Risk | Minimum sensible response |
|---|---|
| Low: ordinary reference document | Confirm source, scan for malware, and review metadata if something looks wrong |
| Medium: invoice, application, employment record | Confirm issuer, key facts, signature status, and exact file version |
| High: legal, financial, medical, or identity evidence | Preserve chain of custody and involve the issuer plus a qualified specialist |
The Honest Conclusion
A good result is not “the checker says authentic.” It is a documented set of independent observations: where the file came from, which bytes were checked, what the signature validator reported, whether metadata and structure fit the expected workflow, and how the issuer confirmed important facts.
If your main concern is later modification, use the more focused PDF edit-check workflow. If the document carries a warning, read why a PDF signature may be invalid before drawing a conclusion.