Was this PDF changed after it was signed?

A digital signature on a PDF covers a byte range — a stated stretch of the file — and not necessarily the whole file. If material was appended afterwards, the signature still verifies perfectly against the bytes it covers, and the file is longer than the thing that was signed. STRATA reads each signature's /ByteRange and prints what it covers against the file's actual size, in the browser, with nothing uploaded. Every other answer to this question is “open it in Acrobat and look at the panel”, which needs Acrobat and asks you to trust its summary.

Why a signature can be valid and the document still different

A PDF signature does not sign “the document”. It signs a range of bytes, recorded in the signature object as /ByteRange: normally everything before the signature and everything after it, up to the end of the file as it was at the moment of signing.

PDFs can be saved incrementally — changes are appended and a new cross-reference section points back at the old one — so anything added later goes after the signed range. The signed bytes are untouched, the cryptography checks out, and the document you are looking at is not the document that was signed.

This is not a flaw somebody should fix. It is what makes a second signature possible: a countersignature has to be added after the first without invalidating it, and appending is the only way to do that. The question is never whether the file was appended to. It is what was appended.

What the readers tell you, and what they leave out

Acrobat is not lying to you. A blue bar saying the signature is valid means the signed bytes match, which is true. A yellow or red bar saying there have been subsequent changes means it noticed an appended revision.

Two things that summary does not give you:

• How much of the file the signature actually covers. A signature covering 340 KB of a 900 KB file is a very different object from one covering all 900 KB, and the difference is a number rather than a colour.
• What changed in the part it does not cover. This is the entire question, and it is the one a signature panel is not built to answer.

And the common case is worse than either: an ordinary electronic signature — an image of a handwriting, a typed name, a drawn squiggle — provides no file-integrity check at all. It shows intent to sign and tells you nothing about whether the rest of the document changed afterwards. Most documents people ask this question about are signed that way.

Answering it properly

1. Read what each signature covers. STRATA lists every signature field with the version it was written in, who it names, when, and how many bytes it covers against the file's total. A signature short of the file's length means material was appended after it.
2. Compare the versions. The same tool walks the cross-reference chain and, for each consecutive pair of versions, compares the document properties, the fonts each page uses, the decoded content of every page, the annotations, the form field values — and renders each page at the same scale to compare them pixel against pixel. That is what turns “something was appended” into “this figure changed on page three”.
3. Decide whether the change matters. A second signature, a filled-in form field, a date stamp: appended, expected, fine. A changed number, a replaced page, a moved figure: appended, and not.

Nothing here is uploaded, which matters because the documents this question gets asked about are contracts, settlements, disclosure bundles and statements — the files least suited to being posted to a checking service.

Things that look like evidence and are not

The Modified date. A modification timestamp later than the creation date means the file was saved again, which is true of almost every PDF that has been through anybody's hands. Adding a comment or rotating a page sets it. It tells you a save happened and nothing about what it contained.

The producer or creator string. Useful context — a contract whose producer is a photo editor is worth asking about — and trivially editable, so it proves nothing on its own.

A visible signature image. A picture of a signature is a picture. It can be copied from one document to another in about ten seconds.

If you are the one signing

Use a certificate-based signature rather than a drawn one when the integrity of the document is the point, and sign the final version rather than signing and then continuing to work.

Where the file has to be accounted for afterwards, take a digest of it at the moment it is final: PROVENANCE records a SHA-256 with a note of where the file came from, and ATTEST does it across a whole bundle. That gives you a fixed point that does not depend on anybody's reader agreeing with anybody else's.

And check the file you are about to send with STRATA before it goes, because the earlier versions it finds are the ones the other side will find too.