Open a PDF's metadata and one field names the software that wrote it:
/Producer. It is free text, anyone can set it to anything,
and it is still one of the most useful things in the file — provided you
know what each string actually means. This table is what the strings
looked like across 1,728 published documents nobody curated.
What the producer field is
Two fields describe a PDF's origin. /Creator names the
application the content came from — Word, a layout tool, a reporting
system. /Producer names the software that wrote the PDF
bytes. When a document is exported once, they often disagree in a
perfectly ordinary way: created in Word, produced by a print driver.
Both are ordinary strings in the document's Info dictionary or XMP packet. Any tool can write them, edit them or remove them entirely, in seconds. So a producer string is evidence, never proof — worth reading, never worth deciding on alone.
The distinction that matters: did it create the file, or consume one?
The useful question is not whether a tool is "consumer" or "professional" software. It is whether the file's existence begins with that tool, or whether the tool took a PDF that already existed and wrote a new one.
- Authoring, print drivers, design tools, browsers — Word, Canva, Illustrator, Print to PDF, Skia/PDF, Google Docs. The document starts here. Naming one says nothing about whether anything changed afterwards, because there was no "afterwards" to change.
- PDF editors and re-distillers — iLovePDF, Sejda, PDF-XChange, Acrobat's interactive editor, Ghostscript. These take an existing PDF as input. That is a claim about the file's history — and still not proof of anything wrong, because merging, compressing, signing and filling in a form are things honest people do to honest PDFs every day.
Getting this backwards is a mistake we made and published: our
producer-fingerprint family used to treat any consumer
tool as a signal, and on a random sample of the Brazilian web that
meant flagging 206 Microsoft Word documents.
The write-up is
here, numbers included.
How to read the last column
The rightmost column is our own false-positive rate, not a fraud rate. Every document in the sample was published by the organisation that made it, so each is presumed genuine, and every score above low counts against us. A producer with a high number is a toolchain whose ordinary output our engine finds unusual — useful to know when you are reading a report on a file that came out of it.
Sample: 985 PDFs from the Library of Congress "1000 .gov" random set plus 743 fetched from a Common Crawl sample of the Brazilian web, scored on engine 1.22.0. Producers appearing fewer than eight times are not listed — 432 distinct strings appeared in total, 252 of them exactly once, which is itself the most useful fact on this page.
The producer strings, and what each one is
| Producer string | What it is | What it means for a document | Docs | Scored above low |
|---|---|---|---|---|
TCPDF 2.5.000_PHP4 (http://www.tcpdf.org) |
Server library | A PHP library that applications use to generate PDFs — invoices, tickets, receipts. Writes an /OpenAction into every file it produces, which is navigation, not active content. | 132 | 1.5% |
(no producer string at all) |
No string | The file names no producing software. Common in high-volume composition engines — several banks' statement pipelines emit nothing — and equally what a stripped file looks like. The absence is a fact, not a finding. | 119 | 23.5% |
Microsoft® Word 2016 |
Authoring tool | Word's own PDF export. A document that BEGINS in Word says nothing about later editing. | 49 | 10.2% |
Microsoft® Word para Microsoft 365 |
Authoring tool | The Brazilian-Portuguese install of Microsoft 365 Word. Same export path as the English build; the language of the string is the language of the installation. | 46 | 8.7% |
Acrobat Distiller 8.1.0 (Windows) |
Authoring tool | Adobe's PostScript-to-PDF converter, the print path for a generation of publishing tools. Routinely emits several font subsets of one typeface in a single pass. | 44 | 20.5% |
Acrobat Distiller 4.0 for Windows |
Authoring tool | A 1999-era Distiller. Still turns up in published archives, because a PDF written then is still a PDF now. | 41 | 2.4% |
Acrobat Distiller 7.0.5 (Windows) |
Authoring tool | Distiller, 2005 vintage. See the 8.1.0 note on font subsets. | 40 | 25.0% |
Acrobat Distiller 5.0.5 (Windows) |
Authoring tool | Distiller, 2001 vintage. | 40 | 7.5% |
iLovePDF |
PDF editor | A web service that takes an existing PDF and writes a new one — merge, split, compress, sign. Its presence means the file passed through a consumer tool AFTER something else created it. That is a claim about history, and honest people merge and compress documents every day. | 37 | 16.2% |
Microsoft® Office Word 2007 |
Authoring tool | Word 2007's PDF export. | 35 | 14.3% |
Microsoft: Print To PDF |
Print driver | Windows' built-in print-to-PDF driver. Whatever was on screen was re-rendered into a new file — which also means every byte-level trace of the original is gone. | 34 | 17.6% |
PDFium |
Browser | The PDF engine inside Chromium. Usually means a browser printed or saved the page. | 29 | 17.2% |
Acrobat Distiller 7.0 (Windows) |
Authoring tool | Distiller, 2005 vintage. | 28 | 28.6% |
Acrobat Distiller 6.0 (Windows) |
Authoring tool | Distiller, 2003 vintage. | 26 | 7.7% |
Microsoft® Word 2010 |
Authoring tool | Word 2010's PDF export. | 25 | 4.0% |
Microsoft® Word 2013 |
Authoring tool | Word 2013's PDF export. | 22 | 9.1% |
Adobe PDF Library 15.0 |
Authoring tool | The engine inside Acrobat and Adobe's own applications. Seen on files Acrobat wrote, including files it wrote while editing one that already existed. | 22 | 45.5% |
Microsoft® Word 2019 |
Authoring tool | Word 2019's PDF export. | 22 | 13.6% |
Acrobat Distiller 6.0.1 (Windows) |
Authoring tool | Distiller, 2003 vintage. | 20 | 20.0% |
Acrobat Distiller 5.0 (Windows) |
Authoring tool | Distiller, 2001 vintage. | 20 | 25.0% |
Acrobat Distiller 9.0.0 (Windows) |
Authoring tool | Distiller, 2008 vintage. | 18 | 22.2% |
libtiff / tiff2pdf - 20100615 |
Image converter | Wraps scanned TIFF images into a PDF. The document is pictures of pages: there is no text layer to analyse, and nothing structural to edit. | 16 | 0.0% |
PD4ML. HTML to PDF Converter for Java |
Server library | Renders HTML to PDF inside a Java application — reports and statements generated by a back end. | 15 | 0.0% |
www.ilovepdf.com |
PDF editor | The same service as the iLovePDF entry, under an older string. See that row. | 15 | 0.0% |
iText 2.1.4 (by lowagie.com) |
Server library | A Java PDF library, widely used for generated statements and forms. Old versions turn up in long-lived back ends. | 14 | 42.9% |
Adobe PDF Library 9.9 |
Authoring tool | See the 15.0 entry. | 14 | 14.3% |
Adobe PDF Library 17.0 |
Authoring tool | See the 15.0 entry. | 14 | 50.0% |
iText 2.1.7 by 1T3XT |
Server library | See the iText 2.1.4 entry. | 13 | 15.4% |
Adobe PDF Library 9.0 |
Authoring tool | See the 15.0 entry. | 12 | 16.7% |
Canva |
Design tool | A web design tool. Its exports are typically a full-page raster — the page IS a picture — which is a fact about how it was designed, not about whether anything was altered. | 12 | 66.7% |
Acrobat PDFWriter 3.02 for Windows |
Print driver | A 1990s Acrobat print driver. | 11 | 9.1% |
Acrobat Distiller 8.0.0 (Windows) |
Authoring tool | Distiller, 2006 vintage. | 11 | 27.3% |
Adobe PDF library 17.00 |
Authoring tool | The same library as Adobe PDF Library 17.0, under a differently-cased string. Producer strings are free text and vendors are not consistent about them. | 11 | 18.2% |
Acrobat Net Distiller 1.0 for Windows |
Authoring tool | A server-side Distiller variant. | 10 | 0.0% |
Adobe PDF library 15.00 |
Authoring tool | See the 15.0 entry, differently cased. | 10 | 30.0% |
Adobe PDF Library 10.0.1 |
Authoring tool | See the 15.0 entry. | 10 | 50.0% |
Adobe PDF Library 10.0 |
Authoring tool | See the 15.0 entry. | 9 | 66.7% |
GPL Ghostscript 8.15 |
Re-distiller | Ghostscript rewrites a PDF from end to end. Whatever it processed, the output is a NEW file — which is also the operation that launders most byte-level evidence. | 9 | 22.2% |
Acrobat PDFWriter 4.05 for Windows NT |
Print driver | A 1990s Acrobat print driver. | 8 | 12.5% |
Microsoft® Word for Microsoft 365 |
Authoring tool | Current Word's PDF export. | 8 | 0.0% |
Reading a file of your own
The metadata viewer shows every field a PDF carries, including both origin strings, with nothing stored. The revision history answers the question a producer string cannot: how many times the file was saved, and which save changed the page. And the metadata forensics guide puts both in context.