You received a document with a disputed history
See whether it contains validated incremental saves and which objects changed at each boundary. The result supplies chronology evidence, not an authorship conclusion.
PDF Forensic Analyzer
Trace a PDF’s revisions, objects, metadata, actions, signature coverage and visual differences. The file stays in your browser, and every result states what it proves and what it does not.
Runs on your device. Nothing is uploaded.
Drop a PDF here
PDF · processed on this device
Choose the lighter tool when it answers the question
Who Power Mode is for
Power Mode is useful when the location and history of evidence matter. It is unnecessary overhead for a quick properties check.
A PDF came from an unfamiliar sender
Inventory JavaScript, launch actions, external links and attachments as inert evidence before deciding how the file should be handled.
A signature may have been followed by edits
Check the signature ByteRange and whether bytes follow its covered region. Cryptographic validity and certificate trust remain separate questions.
You have a known copy to compare
Compare hashes, metadata, page counts, positioned text and rendered pixels locally. Differences are located without being labelled fraudulent.
Your software generated a strange PDF
Walk its xref chain and object graph, inspect decoded streams, and jump from a finding to exact bytes while debugging the writer.
You only need current properties
Use the ordinary metadata viewer. It starts faster and presents Author, Creator, dates, XMP and embedded-image EXIF without the forensic workspace.
Open Metadata Viewer →What Power Mode examines
The ordinary metadata viewer answers what the current document exposes. This workspace goes down to save boundaries, indirect objects, signed byte ranges and rendered page evidence.
Validated revision history
Follow startxref and /Prev chains, distinguish xref tables and streams, and locate objects added, replaced or freed at each save boundary.
Object graph and orphan scan
Separate reachable, unreferenced, superseded and free objects. Inspect raw dictionaries, streams and every discovered XMP packet.
Signature evidence
Check ByteRange geometry, signed coverage, later changes and supported CMS signatures while keeping certificate trust clearly separate.
Known-good comparison
Compare metadata, pages, positioned text, fonts and rendered pixels against an optional reference PDF that stays on your device.
Byte-level provenance
Move from a finding to its object, revision, page region or hexadecimal byte window and export the evidence in open formats.
Local and deterministic
qpdf, PDFium and the signature verifier run in a disposable browser worker. There is no account, upload, model or hidden risk score.
How the history is built
A save boundary is more than an EOF marker
PDFs can append new cross-reference data while leaving earlier object definitions in place. Power Mode follows the current startxref, validates that target, and walks each trailer’s /Prev link. A linearized file or the text %%EOF inside a stream is not counted as an edit.
Strict results and recovered results remain separate. When the xref chain is broken, the report states exactly what could not be verified instead of quietly replacing history with a best guess.
Interpretation limits
Evidence is not an authenticity verdict
- Incremental saves, mixed fonts and unreferenced objects occur in ordinary documents.
- A valid CMS signature proves that covered bytes match a key. Browser-only analysis does not establish that the certificate owner is trustworthy.
- Pixel and text differences show where two renders differ. They do not explain why.
- The SHA-256 hash identifies the analyzed bytes, but this report is not a legal chain-of-custody system.
Coverage and safety limits
Power Mode accepts PDFs up to 100 MiB and also checks the device’s estimated browser-memory budget. Structural analysis covers the full admitted file unless a parser safety limit is reached. Visual analysis initially covers up to 20 pages or 40 megapixels and reports every page left outside that budget.
Selected stream previews are capped and time-bounded. Embedded scripts, XML and URLs are displayed as inert text and are never executed or followed. Passwords are written only to the disposable worker’s memory and disappear when that worker closes.
For a quick current-state report, use the PDF Metadata Viewer. For a second parser on sensitive or legally consequential work, compare Lyonite’s exported evidence with current desktop qpdf or ExifTool output.