EN
Sign in Check a PDF

Free PDF metadata checker

Last updated: 2026-08-29

Every PDF carries a record of its own making: the software that wrote it, when it was created and last saved, how many times it was written, which fonts it embeds and whether anyone signed it. Drop a file above and read that record in full. It runs in your browser — nothing is uploaded, and no account is asked for.

What a PDF metadata checker reads

How to read PDF metadata: every field explained

Producer and Creator. Creator names the application the document originated in; Producer names the library or driver that wrote the PDF itself. Automated systems fill both consistently, document after document. The table below is the shorthand an examiner carries:
Created versus modified. On a file written once and never touched, the two timestamps are identical or seconds apart. A gap means the file was saved again — which happens when someone edits content, and equally when someone signs, flattens or re-prints it. The gap tells you a second save exists; it does not tell you why.
The trailer identifier. A PDF carries two identifiers: one fixed when the file was created, one rewritten on every save. When the two halves differ, the file has been written at least twice. It is one of the few facts a PDF does not easily hide, and it is why the report prints both halves side by side.
Revisions. A PDF can be updated by appending to it instead of rewriting it, which leaves the previous version inside the file. The report lists each revision with the byte at which it ends and any modification date found inside it, so the sequence of saves can be read directly. Signing and form filling both add a revision legitimately.

The XMP packet: a viewer for a PDF's edit history

Where it survives, this is the most direct account a PDF gives of its own past: each entry names an action, the software that performed it and when. Some editors maintain it faithfully, some strip it entirely — so a missing history is not a finding, while a present one is often the whole story.
Fonts and subset prefixes. A prefix such as ABCDEF+ means only the glyphs actually used were embedded. Two different subsets of one typeface in a single document mean the text came from two different sources — worth locating on the page.
Text layer versus image. A generated document carries selectable text. A file with no text layer is a picture of a document; the numbers on it cannot be read by any structural analysis, which is precisely why altered documents are so often re-scanned before they are sent on.
Signatures and encryption. A digital signature covers the revision that existed when it was applied — anything appended afterwards sits outside it. Encryption flags describe what the issuer permitted; a document that arrives with those restrictions gone has passed through something that removed them. Validating a signature's certificate is a separate step this tool does not perform.

Can a PDF have a virus?

Yes — and no metadata tool can tell you whether a particular one does. A PDF is not only a picture of a page. The format allows embedded JavaScript, actions that fire the moment a document is opened, actions that launch an external program, form data submitted to an address written inside the file, attached files and links — and the large PDF exploits have ridden on those. What this page adds is not a verdict but the list: the report's Active content block names what a file carries, before you open it in a reader that would act on it.
What this is not. It is not an antivirus. It matches no malware signatures, and nothing in your file is opened, executed or sent anywhere — the parsing happens in your browser, like every other block on this page. Every item on that list is also entirely ordinary somewhere: an interactive tax form carries scripts by design, an e-invoice carries an attachment by design. A statement from a bank normally carries none of them, which is why the block counts rather than judges.

How to check PDF metadata without a tool

Some of these fields are visible without any tool: open the file in Adobe Reader and go to File → Properties. What a viewer will not show you is the revision list, the identifier pair, the XMP history or the font map — which is what the checker above adds. For the manual walkthrough, see how to tell if a PDF has been edited.

What metadata cannot establish

Metadata is what a file says about itself, and a careful forger can make it say anything. Generative tools now produce documents with plausible fields from the start. Clean metadata is therefore not proof of authenticity, and a surprising producer is not proof of fraud — a legitimate document that someone re-saved once looks, in these fields, much like a document someone edited.
When the document matters — a bank statement, a payslip, an invoice — the question moves from what the file declares to how it is built: the object structure beneath the page, what each revision actually changed, how the text is composed, and whether the visible layer is consistent with the file that carries it. That is what the full forensic check reads.

Frequently asked questions.

Is my file uploaded anywhere?

No. The document is opened and parsed by your own browser; the bytes never leave your device. We record only that a check happened, with the producing software's name and a few counts — never the file name, the document itself, or a fingerprint of it.

How can I check for myself that the file stays on my device?

Open your browser's developer tools, switch to the Network tab and run a check: the document appears in no request. A blunter test works just as well — open this page, disconnect from the network, then pick your file. The report still appears, because the parsing code is already in your browser and the document never needs to travel.

Is the PDF metadata check really free?

Yes, and it needs no account. Everything the tool reads is shown in full. The paid product is the forensic report, which analyses the file's internal construction rather than the fields it declares about itself.

Who created this PDF?

Two fields answer that, and they answer different things. Creator names the application the document originated in; Producer names the library or driver that wrote the PDF itself. The report shows both in full, along with any non-standard fields the issuing system added. Note what they cannot give you: they name software, not a person, and either can be rewritten.

How do I check when a PDF was last modified?

The report prints the creation and modification timestamps side by side, then adds two things a viewer's Properties dialog will not: the trailer identifier pair, whose halves differ once a file has been written more than once, and the revision list with any modification date found inside each revision. Treat all three as claims the file makes about itself — a re-save that changed nothing looks, in these fields, much like one that changed everything.

Does it show a PDF's edit history?

Where the file still carries one, yes. The XMP packet can hold a history log naming each action, the software that performed it and when; the report recovers that packet even from compressed streams, and lists the file's revisions beside it. Many editors never write such a log and some strip it, so a missing history is not a finding — while a surviving one is often the whole story.

Which files can it read?

PDFs, including those whose pages are scans. An encrypted file still shows its encryption and permission flags, but nothing beneath them can be read without the password. Images, Word files and screenshots are outside what this tool reads — in those formats the fields it depends on do not exist at all.

Can clean metadata prove a PDF is genuine?

No. Metadata catches careless edits, and most edits are careless, but every field here can be rewritten by someone who knows how. Absence of traces is not evidence of authenticity — it is only absence of evidence.

Why does my scanned document show almost nothing?

A scan is an image of a page. It carries no text layer, no document fonts, and usually no metadata beyond what the scanner wrote, so most of what this tool reads simply is not there — which is itself worth knowing about a document you were asked to trust.

Can a PDF contain a virus or malware?

Yes. The format allows embedded JavaScript, actions that fire on opening, launch actions naming an external program, and attached files — and PDF exploits have used all four. This page reads whether a file carries any of them and counts them in the Active content block. It does not match malware signatures and it is not an antivirus: it reports what is inside the file, not whether that content is harmful. Nothing is executed, because the file is parsed in your browser and never opened in a reader.

How do I check whether a PDF contains JavaScript?

Drop the file above. The Active content block reports whether the document carries scripts and where they are attached — to the document, to a page, or to a form field — and names the trigger that would run them, such as OpenAction, which fires the moment a reader opens the file. Scripts on their own are not evidence of anything: interactive tax and government forms use them by design. A bank statement normally carries none.

What does the full check do that this page does not?

This page reads what a document declares about itself. The full check reads how it is built: the object structure beneath the page, what each revision actually changed, how text and images are composed, and whether the visible layer is consistent with the file carrying it. It returns a verdict with an integrity score and a report you can export. That work needs a server, which is why it asks for an account and this page does not.