Was this pay stub edited after payroll wrote it?

Editing a pay stub leaves marks in the file. Payroll wrote it once; a PDF editor saves by adding to the end, so the original amount is still in the bytes. Drop the PDF and see what the file records about its own history.

What it looks for

No account, no upload retained. Parsed in memory, discarded with the response.

Drop a pay stub here, or browse

PDF or photo · Max 10 MB · processed in memory, never stored

No pay stub handy? Try the samples:

Three fictional documents: a utility statement, because a real employer's pay stub cannot be published, and the mechanics are identical: the edited copy has a second revision that changed the printed total, and the signed copy was altered after signing.

What this checks

Most edits to a pay stub: a raised gross, a changed employer, a shifted pay date. Are made by opening the payroll system's PDF in an editor and saving it. That leaves traces the editor cannot help writing:

A PDF grows by appending, so an edited pay stub still contains the page payroll wrote.
ONE EDITED FILE, TOP TO BOTTOM REVISION 1 · PAYROLL WROTE THIS %PDF-1.7 · /Producer the page, its fonts, the real amount xref · trailer · %%EOF REVISION 2 · APPENDED LATER a replacement page, a retyped amount xref /Prev · trailer · %%EOF Which tool wrote the file. A consumer editor here is a fact worth explaining. Where a signature stops covering. Anything below this line was added after signing. A number typed in a different tool. It brings a second subset of the typeface with it. Counting revisions is exact. What a second revision means is not: see below.

This is the shape of an edited file, not a finding of fraud. An HR system that stamps, merges or watermarks a payslip appends a revision the same way an edit does, and the report names the benign cause next to every signal.

  • An appended revision. The payroll system wrote the file once; PDF editors save by adding to the end of it, not rewriting it. The original page, the real amount, is still in the bytes, and the report says what changed between revisions.
  • The wrong toolchain. Payroll platforms print through server-side libraries. A stub whose metadata names a consumer PDF editor is a fact worth explaining, and the report separates tools that create documents from tools that consume one.
  • An amount in the wrong font. Retyping one number embeds a second subset of the typeface, a signature of text added with a different tool. On single-revision files this is reported as information rather than escalated, because ordinary generators can produce it too, that recalibration is published, with the false-positive study that forced it.
  • Metadata that argues with itself: a creation stamp from one day and a modification stamp from another, ID pairs and toolchain claims that do not agree with the file's own revision count.

What a signal does, and does not, mean

Every finding is reported with its evidence and its benign explanation, because every one of these traces has an honest cause too. An appended revision is also what an HR system that post-processes its PDFs produces: stamping, merging or watermarking a payslip appends a revision exactly the way an editor does. A stub that went through a scanner has a scanner's structure, not a payroll system's. A stub printed to PDF by the employee, because that was the only way to save it, is a cleanly written file that says nothing either way. This page reports signals, never a fake/genuine verdict. The reader who knows where the document came from is the only one who can weigh them.

The limits run the other direction too. A stub generated from scratch (a template rebuild, a pay stub generator) carries no editing traces, because nothing was edited: the file is cleanly written, just not by an employer. And a photographed stub has no revision chain or fonts to read; the image engine reports what image metadata and pixels expose, which is less, and the report says which engine ran. A quiet result is evidence, not proof.

For landlords, HR and lenders

Edited pay stubs turn up in income verification: a rental application, a background check, a loan file. Signals mean questions, not a caught forger: ask for the original download from the payroll portal, or verify employment at the source. A quiet result is consistent with an untouched file, and is also what a competent re-generation looks like. For a decision that matters, the employer's confirmation outranks any file inspection. The field guide walks every signal this page can raise, with real examples.