What you need
The PDF exactly as you received it, not a printed or re-exported copy, and ideally the version you sent. The analysis runs in your browser and the document is never uploaded. The same tool also reads Word, Excel and PowerPoint files, where it shows tracked changes, comments and hidden text.
Reading the result
A PDF can be changed in two ways. Most editors that rewrite the whole file leave no history behind. But many tools, including those that add comments, fill forms or sign, use an incremental save: they append the changed objects to the end of the file and leave the original bytes in place. Document Forensics reconstructs each of those saves.
Here is a typical pattern for a signed agreement that was quietly modified:
| Tab | What it shows |
|---|---|
| Overview | 3 revisions; more than one producer wrote the file |
| Revision History | Revision 1: original save. Revision 2: the signature. Revision 3: a different producer, a few objects changed |
| What Changed (2 → 3) | Page 2: Text removed payment within 30 days, Text added payment within 90 days |
| Signatures | Covers only the first part of the file |
Read it in order. Revision 2 is where the signature was applied, so the signature covers revisions 1 and 2. Revision 3 came later, from different software, and changed the payment terms on page 2. Many PDF readers show the latest version without any warning, so the reader sees "90 days" next to a signature that was made over "30 days".
A file with a single revision and a signature that covers the whole file is the clean case. A file with one revision and no signature tells you little: it may have been rewritten completely by an editor that keeps no history.
Common pitfalls
- Calling every extra revision tampering. Signing itself adds a revision, and so do form fills and annotations. Look at what changed, not how many saves there are.
- Assuming no history means no edits. "Save As" in many editors, printing to PDF and online converters produce a fresh file with one revision. Only a comparison with your own copy, or a checksum, rules out changes.
- Over-reading the redaction check. Table shading and figure overlays also sit on top of text. Each result is a lead to look at, not a verdict.
- Treating "signature present" as "signature valid". This tool reports coverage only. Verify the certificate and signature in a validating reader.
- Analysing an encrypted file. The structure of an encrypted PDF is readable, but its text and streams are not, unless it uses an empty user password. The Overview says which case applies.
Going further
For contracts and invoices, keep the SHA-256 of every version you send. A later dispute then comes down to comparing two hashes, and Document Forensics shows exactly what differs when they do not match.