What PDF Metadata Reveals About a Document — and What It Doesn’t
Producer, Creator, XMP and dates: what each metadata field tells you about where a PDF came from, how fraudsters hide it, and why missing metadata is a signal too.
Every PDF carries information about itself: which software created it, when, and sometimes much more. For document review, metadata is a quick and revealing first look.
The fields that matter
- Producer — the software that wrote the PDF (for example, a bank's statement system, a browser's print engine or a PDF editor).
- Creator — the application the content came from (a word processor, a design tool, a reporting system).
- Creation and modification dates — when the file was made and last changed.
- XMP metadata — a richer block that may include history entries from editing tools.
What it can reveal
- A "bank statement" produced by a design or word-processing tool.
- A file printed from a browser — sometimes after the web page was edited.
- A document passed through an online PDF editor or converter.
- A modification long after creation.
What it can't reveal
Metadata can be stripped or rewritten. Its absence is itself unusual for documents generated by banks and payroll systems — but it proves nothing alone. And genuine documents sometimes pass through legitimate tools.
How to check it yourself
Open the document properties in your PDF reader. For deeper inspection, forensic tools read the raw metadata and the XMP history.
How we use it
ThisVerify reads metadata alongside file structure, pixels, visual layout and arithmetic, and flags software that should never appear in the document type you are checking.