Every save a PDF has had is still inside it

A PDF editor appends changes rather than rewriting the file, so the earlier versions are still there. Drop one and read the chain.

Drop a PDF here, or

Max 10 MB · processed in memory, never stored

No PDF handy? Try the samples:

Three fictional documents: one with a single revision, one whose second revision rewrote the printed total, and one that was signed before that happened, so the signature no longer covers the page.

What a revision actually is

PDF has a feature called incremental update. When an editor saves a change, it does not rewrite the document: it appends the objects that changed, plus a fresh cross-reference table, to the end of the file. A PDF saved three times contains all three states, one after another, and the earlier ones are still there to be read.

This is deliberate, and it is what makes digital signatures possible . A signature covers a defined range of bytes, and appending after it leaves that range intact and checkable. It is also why a document can quietly carry the version of itself that somebody meant to replace.

Saving a PDF three times leaves all three states in the file, one after another: which is exactly what makes a signature checkable, and exactly what lets a document carry a version somebody meant to replace.
ONE FILE · THREE SAVES · READ LEFT TO RIGHT SAVE 1 SAVE 2 SAVE 3 the whole document only what changed only what changed xref · trailer · %%EOF xref · trailer · %%EOF xref · trailer · %%EOF each /Prev points back at the one before why the format works this way a signature covers a byte range; appending after it leaves that range intact and checkable and what it costs nothing is ever removed, so the document keeps the version somebody meant to replace A tool that rewrites the whole document instead flattens all of this into one revision, and the chain is gone.

More than one revision is not a finding

Signing adds a revision. So does filling in a form field, stamping a document number, applying a payroll system's watermark, or opening the file in a viewer that saves on close. In a sample of published Brazilian public contracts, the country's signature infrastructure produced multi-revision documents by design, which is why the count alone tells you nothing.

What the timeline marks instead is which revision replaced page content, an image, or a page object. The changes that altered what a reader sees. A revision that only added a signature dictionary and some bookkeeping is drawn without that mark, because it did not change the document; it attested to it.

What it cannot tell you

A timeline invites a story the data does not support. Three limits, stated before you read one into it.

  • Not which tool made each save. A PDF records one producer and one creator for the whole file, not one per revision. The page shows that string once, labelled as document-level. Any tool that names a different program per revision is inventing it.
  • Not when each save happened. The two dates a PDF carries, creation and modification, are document-level too, and both are editable text fields. There is no per-revision clock.
  • Not what the earlier version said. The timeline reports which objects a revision replaced, by kind and number, not the words that changed. If you hold the original, comparison answers that question properly: it can show that one file provably contains the other, and name exactly what the appended objects overwrote.
A PDF records one producer and two dates for the whole file, not one per revision: so any tool that names a program or a clock per save is inventing it.
WHAT THE CHAIN ACTUALLY CARRIES which objects each revision replaced by kind and by number whether any of them was page content, an image or a page object AND WHAT IT DOES NOT which tool made each save when each save happened what the earlier version said one producer and two dates, document-level and editable SO THE MARK ON THE TIMELINE MEANS ONE THING A revision that replaced page content, an image or a page object changed what a reader sees, and is marked. One that only added a signature and some bookkeeping is drawn without it. It attested, it did not change.

When the chain is worth acting on

A document that claims to be an original and carries several saves, the last of which rewrote page content, is a document worth a question, not an accusation. Ask for the issuer's own download. The edited-PDF guide walks the signals that usually accompany it, and the field guide lists every family with its benign causes. As everywhere on this site: these are signals, never a verdict.