Can a PDF Change After It Is Sent or Signed?

The short answer

A PDF saved on your device does not change by itself, and the sender cannot reach into your copy and edit it remotely. That covers the common worry. The bytes stay the same until something on your device changes them.

What can change is everything around that copy. A file in a shared folder can be replaced for everyone. A link can start pointing at a new version. An attachment can be swapped before it reaches you. And once a copy is with someone else, they can edit it, signed or not. The real question is rarely "can it change?" but "would anyone be able to tell?"

What can change, and how you would notice

The risk depends on where the file sits and who else can reach it.

What happens when a signed PDF is edited

First, separate two things people call a signature. A picture of a signature, or a name typed on the page, protects nothing. It is part of the page and can be edited or moved like any other content. A digital signature is a cryptographic check over the file's bytes, and a PDF viewer can report if they changed afterwards.

Many editors refuse to change a signed file, but the signature does not physically lock it. Someone can still alter the bytes, and what a digital signature gives you is detection: the viewer shows that the document was modified after signing. Some changes can be allowed by design, such as filling in form fields, adding comments or adding more signatures. That is why a signature panel can show a valid signature with later changes listed. Read those details, not only the tick.

Detection also depends on the software doing the checking. Researchers led by Ruhr University Bochum showed that content could be added to signed PDFs without most of the 22 viewers they tested noticing, using the same add-to-the-end saves that PDFs use normally. Vendors patched the flaws they reported, and related issues have been found since. Keep your viewer updated, and for a document that really matters, check it in a second validator.

• The Incremental Saving Attack The research on changing signed PDFs through incremental saves.
• Adobe on signed PDFs What Acrobat allows after a file has been signed.

The argument starts after you send it

The hard cases are rarely technical. A customer forwards back an invoice with a different total. A lawyer quotes a clause that is not in the version you remember. Someone receives payment instructions in your name with one changed digit. Both sides hold a PDF, both PDFs look real, and neither file can say which one came first.

The original email helps less than people expect. It shows that something was sent, and your sent folder is yours to control. A later PDF has no reason to look different from the real one. What settles this is a record, made when the document left you, of exactly what it was.

How to send a PDF so a change shows

Fingerprint it before it leaves. The hash of the final file is your record of exactly what you sent, and any later copy either matches it or does not.

For documents where a change costs money, such as wire instructions, capital calls and closing documents, use an Evidence Room. Your browser fingerprints the file, records that fingerprint in a signed ledger and encrypts the file before upload, so Invoance holds no readable copy and no key that opens it. Each named recipient opens their own link with an emailed code and needs no account. Their device decrypts the file and compares it with your fingerprint before saving it.

Every open and download goes into a signed log, so you can show what was sent, who received it and when. If an altered copy turns up later, anyone holding it can drop it on the file's public proof page and see no match, with nothing uploaded.

A room does not stop people changing their own copy once it is downloaded, and anyone who can open a file can copy it. The code is as strong as the recipient's inbox, unless the room requires a passkey. It also does not check bank accounts or move money. What it gives you is a way to tell the real file from the changed one.

• Evidence Rooms Who it is for, what it holds and what it never holds.
• How to prove the wire instructions came from you The evidence for each part of that claim.

If you received a PDF you are not sure about

1. Do not act on it yet, especially if it changes where money goes or arrives with pressure to hurry.

2. Check the signature. If the file claims to be digitally signed, open the Signature panel and read what it reports, including any changes after signing.

3. Ask for something to compare. Request the sender's proof link or SHA-256 fingerprint, using contact details you already had, not the ones in the message. If they have a proof page, drop your copy on it.

4. If money is involved, call a number you already trust and read the details back. A file check is no reason to skip your usual call-back.

• How to tell if a PDF has been edited or backdated Five checks you can run on the file itself.