/Producer names the software that wrote a PDF. It is free
text, anyone can set it to anything, and it is still one of the most
useful fields in the file. Provided you know what each string means.
What the producer field is
Two fields describe a PDF's origin. /Creator names the
application the content came from: Word, a layout tool, a reporting
system. /Producer names the software that wrote the PDF
bytes. When a document is exported once, they often disagree in a
perfectly ordinary way: created in Word, produced by a print driver.
Both are ordinary strings in the document's Info dictionary or XMP packet. Any tool can write them, edit them or remove them entirely, in seconds. So a producer string is evidence, never proof . Worth reading, never worth deciding on alone.
Did the tool create the file, or consume one?
Naming an editor is a claim about the file's history, and it is still not proof of anything wrong: merging, compressing, signing and filling in a form are things honest people do to honest PDFs every day. Naming an authoring tool is not even that much. The document started there.
Getting this backwards is a mistake we made and published: the write-up is here, numbers included.
How to read the last column
The rightmost column is our own false-positive rate, not a fraud rate. Every document in the sample was published by the organisation that made it, so each is presumed genuine, and every score above low counts against us. A producer with a high number is a toolchain whose ordinary output our engine finds unusual, useful to know when you are reading a report on a file that came out of it.
Sample: 985 PDFs from the Library of Congress "1000 .gov" random set plus 743 fetched from a Common Crawl sample of the Brazilian web, scored on engine 1.22.0. Producers appearing fewer than eight times are not listed.
The producer strings, and what each one is
| Producer string | What it is | What it means for a document | Docs | Scored above low |
|---|---|---|---|---|
TCPDF 2.5.000_PHP4 (http://www.tcpdf.org) |
Server library | A PHP library that applications use to generate PDFs: invoices, tickets, receipts. Writes an /OpenAction into every file it produces, which is navigation, not active content. | 132 | 1.5% |
(no producer string at all) |
No string | The file names no producing software. Common in high-volume composition engines (several banks' statement pipelines emit nothing), and equally what a stripped file looks like. The absence is a fact, not a finding. | 119 | 23.5% |
Microsoft® Word 2016 |
Authoring tool | Word's own PDF export. A document that BEGINS in Word says nothing about later editing. | 49 | 10.2% |
Microsoft® Word para Microsoft 365 |
Authoring tool | The Brazilian-Portuguese install of Microsoft 365 Word. Same export path as the English build; the language of the string is the language of the installation. | 46 | 8.7% |
Acrobat Distiller 8.1.0 (Windows) |
Authoring tool | Adobe's PostScript-to-PDF converter, the print path for a generation of publishing tools. Routinely emits several font subsets of one typeface in a single pass. | 44 | 20.5% |
Acrobat Distiller 4.0 for Windows |
Authoring tool | A 1999-era Distiller. Still turns up in published archives, because a PDF written then is still a PDF now. | 41 | 2.4% |
Acrobat Distiller 7.0.5 (Windows) |
Authoring tool | Distiller, 2005 vintage. See the 8.1.0 note on font subsets. | 40 | 25.0% |
Acrobat Distiller 5.0.5 (Windows) |
Authoring tool | Distiller, 2001 vintage. | 40 | 7.5% |
iLovePDF |
PDF editor | A web service that takes an existing PDF and writes a new one: merge, split, compress, sign. Its presence means the file passed through a consumer tool AFTER something else created it. That is a claim about history, and honest people merge and compress documents every day. | 37 | 16.2% |
Microsoft® Office Word 2007 |
Authoring tool | Word 2007's PDF export. | 35 | 14.3% |
Microsoft: Print To PDF |
Print driver | Windows' built-in print-to-PDF driver. Whatever was on screen was re-rendered into a new file: which also means every byte-level trace of the original is gone. | 34 | 17.6% |
PDFium |
Browser | The PDF engine inside Chromium. Usually means a browser printed or saved the page. | 29 | 17.2% |
Acrobat Distiller 7.0 (Windows) |
Authoring tool | Distiller, 2005 vintage. | 28 | 28.6% |
Acrobat Distiller 6.0 (Windows) |
Authoring tool | Distiller, 2003 vintage. | 26 | 7.7% |
Microsoft® Word 2010 |
Authoring tool | Word 2010's PDF export. | 25 | 4.0% |
Microsoft® Word 2013 |
Authoring tool | Word 2013's PDF export. | 22 | 9.1% |
Adobe PDF Library 15.0 |
Authoring tool | The engine inside Acrobat and Adobe's own applications. Seen on files Acrobat wrote, including files it wrote while editing one that already existed. | 22 | 45.5% |
Microsoft® Word 2019 |
Authoring tool | Word 2019's PDF export. | 22 | 13.6% |
Acrobat Distiller 6.0.1 (Windows) |
Authoring tool | Distiller, 2003 vintage. | 20 | 20.0% |
Acrobat Distiller 5.0 (Windows) |
Authoring tool | Distiller, 2001 vintage. | 20 | 25.0% |
Acrobat Distiller 9.0.0 (Windows) |
Authoring tool | Distiller, 2008 vintage. | 18 | 22.2% |
libtiff / tiff2pdf - 20100615 |
Image converter | Wraps scanned TIFF images into a PDF. The document is pictures of pages: there is no text layer to analyse, and nothing structural to edit. | 16 | 0.0% |
PD4ML. HTML to PDF Converter for Java |
Server library | Renders HTML to PDF inside a Java application: reports and statements generated by a back end. | 15 | 0.0% |
www.ilovepdf.com |
PDF editor | The same service as the iLovePDF entry, under an older string. See that row. | 15 | 0.0% |
iText 2.1.4 (by lowagie.com) |
Server library | A Java PDF library, widely used for generated statements and forms. Old versions turn up in long-lived back ends. | 14 | 42.9% |
Adobe PDF Library 9.9 |
Authoring tool | See the 15.0 entry. | 14 | 14.3% |
Adobe PDF Library 17.0 |
Authoring tool | See the 15.0 entry. | 14 | 50.0% |
iText 2.1.7 by 1T3XT |
Server library | See the iText 2.1.4 entry. | 13 | 15.4% |
Adobe PDF Library 9.0 |
Authoring tool | See the 15.0 entry. | 12 | 16.7% |
Canva |
Design tool | A web design tool. Its exports are typically a full-page raster (the page IS a picture), which is a fact about how it was designed, not about whether anything was altered. | 12 | 66.7% |
Acrobat PDFWriter 3.02 for Windows |
Print driver | A 1990s Acrobat print driver. | 11 | 9.1% |
Acrobat Distiller 8.0.0 (Windows) |
Authoring tool | Distiller, 2006 vintage. | 11 | 27.3% |
Adobe PDF library 17.00 |
Authoring tool | The same library as Adobe PDF Library 17.0, under a differently-cased string. Producer strings are free text and vendors are not consistent about them. | 11 | 18.2% |
Acrobat Net Distiller 1.0 for Windows |
Authoring tool | A server-side Distiller variant. | 10 | 0.0% |
Adobe PDF library 15.00 |
Authoring tool | See the 15.0 entry, differently cased. | 10 | 30.0% |
Adobe PDF Library 10.0.1 |
Authoring tool | See the 15.0 entry. | 10 | 50.0% |
Adobe PDF Library 10.0 |
Authoring tool | See the 15.0 entry. | 9 | 66.7% |
GPL Ghostscript 8.15 |
Re-distiller | Ghostscript rewrites a PDF from end to end. Whatever it processed, the output is a NEW file: which is also the operation that launders most byte-level evidence. | 9 | 22.2% |
Acrobat PDFWriter 4.05 for Windows NT |
Print driver | A 1990s Acrobat print driver. | 8 | 12.5% |
Microsoft® Word for Microsoft 365 |
Authoring tool | Current Word's PDF export. | 8 | 0.0% |
See both origin strings in a file you hold
The metadata viewer shows every field a PDF
carries, /Creator and /Producer included:
the file is sent over HTTPS, parsed in memory and never written to
disk. No account, no quota.
The revision history answers the
question a producer string cannot (how many times the file was
saved, and which save changed the page), and
the metadata forensics guide
puts both in context.
Tamperlens reports risk signals, not authenticity verdicts. Signals can have benign causes; combine them with your own decision logic.