How We Validate PDFs
The PDF Validator runs ten basic checks on a file's type, metadata, dates and risky features and summarises them as "Basic checks passed" or "Review Recommended". It is a quick health check, not a standards conformance test. This page lists each check, how the verdict is reached and what the result cannot tell you.
What the validator checks
- That the upload really is a PDF, before anything else is read
- Creation and modification dates, and whether they are consistent
- Who or what is recorded as the creator, and which software produced the file
- Page count, PDF version and encryption reported by the file
- Markers for JavaScript, automatic actions, launch actions and attachments
What a result does not establish
- Conformance with PDF/A, PDF/X or PDF/UA, or any ISO standard
- That every object, font and image in the file is intact
- That the document is authentic, unaltered or safe to open
Step 1: The upload gate
Before a file is read, PDFCheck checks the upload itself. The server detects the content type from the file's bytes rather than trusting the browser, looks for the %PDF- header in the first kilobyte, rejects files that start like a ZIP archive, and rejects files that carry an executable header near the start without a PDF header. Files smaller than 128 bytes or larger than your plan allows are refused.
A file rejected at this stage is not analysed and does not use one of your daily checks. The error message names the reason, for example a missing PDF header.
Step 2: Reading the file
Accepted files are read with pdfinfo, part of the open-source Poppler PDF library. It reports the document information fields (Title, Author, Creator, Producer, creation and modification dates), the page count, the PDF version, encryption, and the tagged and linearized flags. PDFCheck also scans the file for an XMP metadata packet; where XMP and the information dictionary disagree, the XMP value is used for dates, creator tool and producer.
To keep large uploads fast and bounded, this path does not decode page content, fonts or images. The risky-content scan reads only the first 2 MB of the file.
Step 3: The ten checks
Each check produces a pass, a warning or an informational note. The report lists them in this order:
- PDF file type passes when the detected type is application/pdf. It is the only check that can fail the file on its own.
- Creation date passes when a creation date can be read and parsed.
- Date reliability starts at 100 points and loses 30 when there is no creation date, 20 when it cannot be parsed and 40 when the modification date is earlier than the creation date. A score below 80 adds a warning.
- Creator information passes when a creator application or an author is recorded.
- Software identification names the producing program by matching Creator and Producer against a list of 108 known generators. It is informational.
- Modification status adds a warning when the modification date differs from the creation date by more than 60 seconds.
- AI generation check reuses the AI-generator score from our AI detection method; a score of 25 or more adds a warning.
- Content analysis is informational. Because this quick path does not parse the text layer, it reports that the content type could not be determined.
- Page structure passes when a page count above zero can be read.
- Risky content looks for /JavaScript or /JS, /OpenAction, /EmbeddedFile or /Filespec and /Launch markers. Any match adds a warning and is named in the report.
How the verdict is reached
Only four checks can raise warnings: date reliability, modification status, the AI generation check and risky content. The report shows "Basic checks passed" when the file type check passes and fewer than three warnings were raised. With three or more warnings, or a failed file type check, it shows "Review Recommended" together with the number of issues and warnings.
A missing creation date or creator is shown as a failed line but does not change the verdict by itself. Read the individual lines, not just the headline: two warnings still produce "Basic checks passed".
Known false positives and gaps
Markers are matched as text, so a file is flagged when it merely contains the name /JavaScript or /OpenAction, even if the action is harmless, such as opening at a set page or zoom. PDF portfolios and e-invoices with attached XML files legitimately carry embedded files. Any document that was edited, form-filled or signed after creation receives a modification warning, and business documents produced by libraries such as ReportLab raise the AI warning without any AI involvement.
In the other direction, markers stored after the first 2 MB, or inside compressed object streams, are not seen by the text scan. A file can pass all ten checks and still fail in a print workflow, in a strict validator or in an assistive technology.
When you need more than a basic check
For archiving, use the PDF/A Validator to see declaration-level indicators such as the PDF/A identification, embedded fonts and encryption, then confirm conformance with an ISO-based validator such as veraPDF. For accessibility, the Accessibility Checker reports structural signals such as tags and language, but reading order and the quality of alternative text need a person to review them. For signed documents, use the Signature Checker and a validator that checks certificate trust.
Worked examples
How typical files come out, based on the rules above:
| File | Warnings | Verdict |
|---|---|---|
| A report exported from a word processor, never edited, with no scripts | None | Basic checks passed |
| A contract edited a week after creation, with a form that runs JavaScript | Two: modification and risky content | Basic checks passed, with two warnings to review |
| A file whose modification date is earlier than its creation date | Two: date reliability (60 points) and modification | Basic checks passed, with two warnings to review |
| A ReportLab file with no Author, Title or creation date that opens with an /OpenAction | Three: date reliability, AI generation score of 55, risky content | Review Recommended |
Limits and file handling
The Free plan allows 100 checks a day and files up to 50 MB; Pro and AI plans allow files up to 100 MB. The upload is read from temporary request storage and is not copied into long-term storage. The extracted metadata and check results are saved as a report behind a private link. Guest reports are deleted after 90 days; reports owned by an account remain until the account is deleted.
Check a PDF
Upload a PDF to see the ten checks, the warnings and the values they are based on.
Validate a PDF