Guide
How to tell if a PDF has been edited or altered
The only reliable way to tell whether a PDF has been edited is to compare its cryptographic fingerprint (hash) with the one recorded before it was sent. If they match, the PDF is bit-for-bit identical to the one issued; if not, it has been altered, even if it looks the same.
Why isn't it enough to open the PDF and look at it?
PDF editors can change an amount, a date or a bank account number without altering the layout. File properties such as the author or the modification date can also be rewritten, and the file name says nothing about its content. Visual inspection only catches clumsy edits.
What methods are there to check it?
| Method | What it tells you | Limitation |
|---|---|---|
| Visual review | Obvious editing errors | Misses well-made changes |
| Properties and metadata | Declared dates and creating software | Can be edited without a trace |
| Comparison with the original | Differences between two versions | Requires a trusted copy of the original |
| PDF digital signature | Who signed and whether the file changed afterwards | Requires a certificate and a reader that validates it |
| Recorded SHA-256 fingerprint | Whether the file is identical to the recorded one, and since when | The fingerprint must be recorded before sending |
Comparing fingerprints does not depend on keeping a copy or trusting metadata: the recorded fingerprint is enough.
What is a SHA-256 fingerprint and why is it reliable?
SHA-256 is a hash function defined by the US National Institute of Standards and Technology (NIST) in the FIPS 180-4 standard. It turns a file of any size into a string of 64 hexadecimal characters: the same file always produces the same fingerprint, and changing a single bit produces a completely different one.
“The digests are used to detect whether messages have been changed since the digests were generated.”
NIST rates SHA-256 at 128 bits of collision resistance: finding two different files with the same fingerprint would take on the order of 2¹²⁸ operations, beyond the reach of current technology. [NIST]
How do you check it, step by step?
- Before sending the PDF, the issuer records its SHA-256 fingerprint. With TRAMPTO it is computed in the browser, without uploading the file, and a public verification link is issued.
- The issuer sends the sealed document and shares the verification link.
- The recipient opens the link or loads the PDF on the verification page, and their browser recomputes the fingerprint of the file received.
- If the fingerprint matches the recorded one, the document is identical to the one issued. If it does not, it has been modified and should not be accepted.
What is the real risk of an altered PDF?
The costliest case is business email compromise: the attacker intercepts an invoice and changes the bank account number before it reaches the client. The FBI Internet Crime Complaint Center (IC3) annual report records 21,442 such complaints in 2024 and losses of $2,770,151,146, the second-highest loss category in the report. [FBI IC3]
If the invoice has a recorded fingerprint, the payer can check it before ordering the transfer: a changed IBAN produces a different fingerprint.
Does checking the fingerprint have legal standing?
A matching fingerprint is technical evidence of integrity and date, and can be submitted as such in proceedings. It is not equivalent to a qualified electronic signature. Regulation (EU) No 910/2014 (eIDAS) defines an electronic seal, in Article 3(25), as:
«data in electronic form, which is attached to or logically associated with other data in electronic form to ensure the latter's origin and integrity»
TRAMPTO evidences integrity and date, but it is not a qualified trust service provider: where the law requires a qualified seal or signature, one must be used, while the fingerprint can be recorded as well.
Glossary
- SHA-256 fingerprint
- A string of 64 hexadecimal characters obtained by applying the SHA-256 function to a file. It identifies its exact content.
- Integrity seal
- A record of a document's fingerprint on a given date, which makes it possible to check later that it has not changed.
- Verification link
- A public address where anyone can check a sealed document, with no account or installation.
- Seal ID
- A unique identifier that TRAMPTO assigns to each sealing.