What does tamper evident mean?

Why prevention is not on offer

Once a file leaves your control it is bytes on somebody else's disk, and bytes can be rewritten by anyone with an editor. No format can stop that, because the recipient necessarily has the file in order to read it. What can be arranged is that the original state was recorded in a way nobody can retroactively match, so a modified copy fails a check that the genuine copy passes. That is a different guarantee: it does not protect the file, it protects the reader from being fooled by an altered one.

How a PDF signals a change

The signature covers the byte ranges of the document as it stood at signing. A reader recomputes the fingerprint of those ranges and compares it against the signed value. If somebody edits a figure, deletes a clause or replaces a page, the recomputed value differs and the reader reports that the document has been altered since it was signed. Certification goes further by declaring what is permitted afterwards, so a document sealed at the strictest level shows a break for any change at all rather than tolerating annotations or form filling.

The gap between evident and noticed

Detection only helps if somebody looks. A signed PDF forwarded as a printed copy, a screenshot or a flattened export carries none of the signalling, and most people never open the signature panel. That is why the practical arrangement pairs technical evidence with a habit: send the signed file rather than a printout, keep the original rather than a re-saved copy, and check the panel when a document arrives from outside. The technology answers the question, but only if the question is asked.

What tampering looks like in real disputes

Rarely a forged signature. More often a page swapped for a differently worded one, a schedule replaced, a date changed, or a copy circulated that omits an amendment everybody agreed to. Those edits are invisible to the eye because the document still looks like itself. A byte level check catches all of them without needing anybody to compare wording line by line, which is the practical value: it converts an argument about recollection into a mechanical result. Page substitution deserves particular attention, because it is the attack a signature actually defeats and the one people assume it does not. A signature covers the whole file rather than each page separately, so replacing page four of a twelve page agreement invalidates it just as surely as rewriting the price. That is why initialling every page, a habit inherited from paper, adds nothing to a properly sealed document. The habit worth keeping instead is comparing the copy you hold against the copy the other side holds whenever a discrepancy is alleged, since two files that both verify against the same signature are necessarily identical. That comparison takes a minute and settles the question without anybody reading a clause.

The ordering constraint it imposes

Sealing a document is necessarily the last thing that happens to it, because anything appended afterwards is a change. That has a practical consequence for signing workflows: if a certificate of completion is going to be attached to the document, it has to be attached before the seal, not after. Getting that order wrong produces a file that reports itself as modified the moment anyone opens it, which is worse than not sealing it at all, since it looks like evidence of tampering.

What is sealed here, and how

The completed document is signed with a PAdES structure and certified at the strictest permission level, recorded as PAdES-SHA256-DocMDP, so any later edit breaks the signature in any compliant reader. Where the completion certificate is appended to the document, that append happens before certification for the reason above. If certification fails, the envelope is marked failed and the owner is emailed rather than an uncertified file being released, which keeps the meaning of a completed document consistent.

Questions people ask