Detect a Tampered PDF in Python Without the Original
Originally published at htpbe.tech . The version on htpbe.tech stays in sync with the latest detection algorithm — refer to it for the canonical text. A PDF lands in your intake queue — a bank statement, an invoice, a signed offer letter — and you have to decide whether to trust it. There is no “original” sitting in a database to diff against. The applicant emailed you one file. The vendor uploaded one file. That single PDF is all the evidence you have. The usual advice is blunt: without the original, you cannot tell. That is half true. A PDF carries evidence of its own history inside the file itself, so you do not always need the original to spot that something was changed after the document was created. This tutorial reads those internal signals in Python with pypdf and pikepdf , explains what each one means, and is honest about where do-it-yourself heuristics break down. One scope note before we start. This is tamper detection — finding evidence that a file was modified after it was first created. That is a different problem from confirming an identity or fact-checking the numbers on the page. We inspect the document’s structure; we do not ask a bank whether the balance is real. This post is the by-hand, no-original angle. If you would rather skip straight to a hosted integration — submit a URL, get a verdict, route on it — the companion post PDF Tamper Detection in Python: Integrate in Under 50 Lines walks through the API instead. Can you check if a PDF was edited without the original? The common objection is that a single file has no baseline, so any change is invisible. That holds for one specific question: did the visible text change from some earlier draft? Without the earlier draft, you genuinely cannot diff pixel to pixel. But that is not the only question worth asking. A more useful one is: does this file show evidence of having been written to more than once after it was created? That question does not need a baseline. The answer is recorded inside the P