How to Tell If a Word Document Has Been Edited

The short answer

Often, yes. A Word document keeps more about its own history than a PDF does: who created it, who saved it last, how many times it was saved, and, if tracking was on, every insertion and deletion. If the file lives in OneDrive or SharePoint, there may be a full list of earlier versions.

What you cannot do is prove from the file alone that it was not edited. Every clue stored inside a Word file can be changed or removed by someone who wants to, and the dates are the easiest of all. The five checks below catch ordinary and careless edits. The last one is the only check that gives a yes or no answer.

Check 1: read the document's properties

On Windows, open the document and choose File, then Info. The panel on the right shows Created, Last Modified, Last Modified By and Total Editing Time. Choose Show All Properties to see more, including the revision number. On a Mac, choose File, then Properties, and open the Statistics tab.

Read them together. A Last Modified date after the date the document was supposedly finished is worth a question. So is a Last Modified By name you did not expect. The revision number counts saves, so a contract with revision 1 was probably pasted into a fresh file. Total Editing Time counts minutes the file was open for editing, not minutes of work, so treat it as a rough signal.

None of these is proof. A document started from an older file inherits that file's dates and author, and all of these fields can be rewritten, as shown further down.

Check 2: look for tracked changes and comments

Open the Review tab and set the display to All Markup. If changes were tracked and never accepted or rejected, they appear in colour with the name of the person who made each one and the time. The Reviewing Pane lists them all in one place.

To see whether a file is carrying hidden revisions or comments without hunting for them, choose File, Info, Check for Issues, then Inspect Document, and read the results. Close the window without choosing Remove All, because that deletes the very history you are looking for.

The limit is simple: tracking only records changes made while it was switched on. An edit made with tracking off leaves nothing here.

Check 3: open the version history

If the document is stored in OneDrive or SharePoint, choose File, Info, then Version History. Word lists earlier saved versions with the name of the person who saved each one and when. You can open any of them and compare it with the current file.

This is the closest thing Word has to a real edit history, and it is kept by the service, not by the file. A copy that was downloaded and emailed to you carries none of it. If the history matters, ask the person who holds the original location to check it, and bear in mind that services limit how many versions they keep.

Check 4: compare it with a copy you trust

If you have an earlier copy, let Word find the differences. On the Review tab choose Compare, then Compare Documents, and pick the two files. Word builds a third document that shows every difference as a tracked change, down to a single character.

This is the best check when you hold the original, because it does not rely on any history inside the file. It answers the question that usually matters, which is what changed, and it works even if the editor switched tracking off and cleaned up the properties.

Check 5: compare fingerprints

A SHA-256 fingerprint is a short code computed from every byte of a file. Two files with the same fingerprint are the same file. Change one character and the fingerprint is completely different.

If the sender can give you the fingerprint of the file they sent, or a proof link, compute yours and compare. This is the only check here that gives a plain yes or no. Renaming, copying or emailing a file does not change its fingerprint. Opening it in Word and saving it again does, even if you changed nothing you can see, so always fingerprint the file exactly as you received it.

# Mac or Linux
shasum -a 256 offer-letter.docx

# Windows PowerShell
Get-FileHash offer-letter.docx

Why Word's own dates prove very little

A .docx file is a zip archive of small text files. The dates and names Word shows you are a few lines of text in one of them. Anyone can read those lines, and anyone can rewrite them.

We tested this on an offer letter. We changed the salary from 85,000 to 95,000, then wrote the original Created and Last Modified values back into the file. Word's properties for the two files are identical: same dates, same author, same revision number. Only the fingerprints differ.

That cuts both ways. Dates that look wrong do not prove tampering, and dates that look right do not prove the file is original.

unzip -p offer-letter.docx docProps/core.xml

# The lines that matter:
#   <dcterms:created>2026-02-10T09:14:00Z</dcterms:created>
#   <dcterms:modified>2026-02-10T09:31:00Z</dcterms:modified>
#   <cp:lastModifiedBy>HR Team</cp:lastModifiedBy>
#   <cp:revision>2</cp:revision>

Why the dates in the folder do not match the dates in Word

There are two sets of dates, and they come from different places. The Created and Modified dates you see in File Explorer or Finder belong to the copy on your disk. The dates under File, Info are stored inside the document and travel with it.

The disk dates change whenever a copy is made. Download a document, save an email attachment or copy a file to another folder, and the copy usually gets a new Created date. In our test, a plain copy on a Mac got new dates on disk while the dates inside the file and its fingerprint stayed the same. On Windows a copy normally gets a new Created date but keeps its old Modified date, which is how a file ends up "created" after it was last "modified".

So when the two sets disagree, nothing is wrong. The dates inside the file say more about the document, and the dates on the disk say more about your copy.

• How to tell if a PDF has been edited or backdated The same question for PDFs, with five checks.

What each check can and cannot show

Use this as a quick guide to how much weight each check can carry.

If the answer matters

If the document may end up in a dispute, slow down before you investigate. Keep the file exactly as you received it and work on a copy, because opening and saving it changes the properties you want to read. Keep the email or message it arrived in. Ask for the Word file itself, not a PDF or a printout, since those carry none of this history. For anything serious, a forensic document examiner can read details most people never see, such as the editing-session markers Word leaves inside the file.

For documents you send: record the fingerprint first

All of this is easier from the other side. If you are the one sending the offer letter, the contract or the report, you can settle the question before anyone asks it.

Drop the final file in the Invoance dashboard. Your browser computes its fingerprint, and Invoance signs that fingerprint with your organization's key and records the time. The file stays with you unless you choose to store it. Each record has a public proof page: anyone holding a copy can drop it there and see match or no match, with no account and nothing uploaded.

It shows that a copy is the exact file you recorded, and by when it existed. It does not show what changed in a copy that fails, who changed it, or that the contents were true in the first place.

• How to prove a document existed on a certain date How the options compare, from notaries to signed records.
• Verify a file Drop any copy on the public proof page.