How to Check a PDF’s Creation & Modification Dates

Every PDF file carries two dates: one for its creation and another for the last time the file was saved. Open any PDF’s properties, and you'll find both dates displayed. These dates are in plain text format, just like the title or author name. However, anyone with a PDF editor can modify these dates to match their preference, making them a claim rather than a fact.

To correctly check a PDF’s dates, it’s essential to understand the difference between reading and trusting them. The Info dictionary, located in the file’s trailer, holds the CreationDate and ModDate fields. Some PDFs also include these values in an embedded XMP packet. Both of these fields reside inside the file itself and travel with it when shared or moved.

CreationDate signifies when the document was first generated, while ModDate records the last time the file was saved. Any operation that modifies the file, like editing text, adding a digital signature, or running it through a compressor, updates this date. In files that have never been altered, both dates should match or be close enough that the discrepancy is insignificant.

However, it’s crucial to remember that both dates are just claims and not necessarily facts. Editing software can freely alter these fields without raising any alarms. Therefore, a mismatch or suspiciously round number in the dates doesn't always indicate fraud. Conversely, matching dates don't guarantee an untouched file either.

Someone can forge a document and set both dates to whatever they want, including making them identical to hide any edits.

Although CreationDate and ModDate are stored as plain-text strings in a specific format, this format lacks cryptographic protection. They can be rewritten using a text editor, command-line metadata tools, or any PDF editor's "document properties" panel, and the file will open normally afterward without warning of any changes. This lack of tamper-evidence makes the two dates vulnerable to manipulation.

While reading the dates alone provides one honest fact—mismatched dates indicate something was written to the file after its creation—reading them doesn’t tell you whether the file has been tampered with. The honest fact is that a difference in the dates signifies something was written to the file after its creation, but the dishonest fact is that the exact values are self-reported by whatever software last touched the file, and nothing stops that software or a person with a text editor from writing false ones.