A tamper-evident document is a document designed so that unauthorized or unexpected changes made after a known point can be detected. It does not necessarily prevent someone from editing, copying, or replacing the document. Instead, it provides evidence that the document no longer matches the protected version.
Tamper evidence is especially important for contracts, approvals, financial records, policies, certificates, and other documents whose contents must remain trustworthy after issuance or signing. It supports document integrity by helping recipients determine whether the document they received is the same version that was originally approved or signed.
Tamper-evident does not mean tamper-proof
A tamper-evident document reveals that a change has occurred. A tamper-resistant document makes changes more difficult. A supposedly tamper-proof document would be impossible to alter, which is rarely a realistic claim for a digital file.
| Concept | What it means | What it does not guarantee |
|---|---|---|
| Tamper-evident | Changes can be detected after a protected state is established | That changes cannot be made |
| Tamper-resistant | Controls make unauthorized changes more difficult | That every change will be detected |
| Tamper-proof | Suggests alteration is impossible | A practical guarantee for ordinary digital documents |
Passwords, editing restrictions, access controls, and file permissions can discourage or limit changes, but they do not automatically make a document tamper-evident. A person may bypass restrictions, create a new copy, take screenshots, or replace the file entirely.
Reliable tamper evidence usually depends on cryptographic verification or a trusted record that can be compared with the document.
How hashes reveal document changes
A cryptographic hash function converts a document’s data into a fixed-length value, often called a hash or digest. Even a small change to the underlying data, such as changing a number, deleting a sentence, or modifying certain file elements, normally produces a different hash.
A system can calculate the document’s hash when it reaches an approved state and calculate it again during verification. If the values differ, the file has changed.
A hash alone does not identify who changed the document or prove who approved the original version. It also needs a trustworthy reference point. If an attacker can replace both the document and an unprotected stored hash, the comparison may provide little assurance.
For stronger protection, the hash can be secured through a cryptographic signature, a trusted timestamp, or another independently protected record.
Digital signatures and cryptographic seals
A digital signature uses cryptography to connect a protected document state with a signing key. In a typical certificate-based process, software calculates a hash of the document and signs that hash using the signer’s private key.
A verifier uses the corresponding public key to check the signature. If the protected content has changed, verification should report that the signed data no longer matches.
A digital certificate can bind the public key to information about a person, organization, or system. Certificate validation may also consider the issuing certificate authority, trust chain, validity period, intended use, and revocation status.
Cryptographic seals can apply similar integrity protection on behalf of an organization or automated system. The word “seal,” however, can have different technical and legal meanings depending on the jurisdiction and implementation. A visible badge, stamp, lock icon, or image that says “sealed” is not sufficient evidence by itself.
A signature image pasted into a document is also different from a cryptographic digital signature. The image may show an intention to sign, depending on the surrounding process, but it does not independently reveal later changes to the file.
The role of audit records
An electronic signature audit trail can record events such as when a document was created, sent, opened, signed, downloaded, or completed. It may also record authentication steps, timestamps, document identifiers, and changes in workflow status.
These records can strengthen the evidence surrounding a document, but an audit trail is not automatically tamper-evident. Its reliability depends on how it is generated, stored, protected, and linked to the relevant document version.
For example, an audit record may show that a person signed a document at a particular time. A cryptographic signature may separately show whether the protected document content has changed since that signing event. Together, these controls can provide more useful evidence than either one alone.
What happens when a signed PDF is edited
Editing a signed PDF can affect its signature status, but the exact result depends on the type of signature, the PDF structure, the validation software, and the changes permitted when the signature was applied.
Some PDF signatures protect the document against all later changes. Others may allow specified actions, such as completing approved form fields, adding another signature, or placing annotations. PDF software may preserve the original signed revision and append later changes rather than rewriting the entire file.
As a result, a validator might report one of several outcomes:
- The signature is valid and the document has not changed.
- The signature is valid, but permitted changes were made after signing.
- The signature covers an earlier revision, and later changes require review.
- The document was altered in a way that invalidates the signature.
- The signature cannot be fully validated because a certificate, trust chain, or revocation check is unavailable.
A document that still displays a signature appearance is not necessarily unchanged. The visible signature block may remain on the page even when validation reports a problem. Users should inspect the signature status through suitable validation software rather than relying only on what the PDF looks like.
See can you edit a PDF after signing? for a fuller explanation of the practical effects of post-signing edits.
What tamper evidence can and cannot establish
Tamper evidence can help answer whether a document matches a protected version. Depending on the method used, it may also help establish which key signed the document and when related workflow events occurred.
It does not automatically prove:
- That every statement in the document is true
- That the signer understood or freely accepted the contents
- That the person controlling a signing account was the intended signer
- That the original document was lawful or correctly prepared
- That no one accessed, copied, or disclosed the file
- That a signature satisfies every legal requirement in every jurisdiction
Integrity, authenticity, confidentiality, and legal enforceability are related but separate questions. Encryption can protect confidentiality. Authentication can increase confidence in identity. Digital signatures can support integrity and origin verification. Applicable law and evidence determine the legal effect of a particular transaction.
How tamper evidence appears in real workflows
A company sends an employment agreement for signature. After everyone signs, a cryptographic signature protects the completed PDF. If someone later changes the salary amount, validation reports that the protected content no longer matches.
An organization publishes an approved policy and records its hash in a controlled system. Employees can compare downloaded copies with the trusted hash to detect unauthorized replacement or modification.
An automated billing system digitally seals invoices before delivery. A recipient can verify whether an invoice has changed after issuance and whether the seal is associated with the expected organization or system.
In each example, the document can still be copied or modified. The important feature is that the protected state can be checked and unauthorized changes can be exposed.
FAQ
Can a tamper-evident document still be edited?
Yes. Tamper-evident controls generally detect changes rather than physically preventing them. Editing may invalidate a signature, create a new revision, or trigger a warning during verification.
Is a password-protected PDF tamper-evident?
Not necessarily. A password may restrict opening or editing, but it does not always provide reliable evidence that the file remained unchanged. Cryptographic hashes or signatures provide stronger integrity checks.
Does a visible signature make a document tamper-evident?
No. A typed name, drawn signature, or pasted signature image does not independently protect document integrity. Tamper evidence requires controls that can detect changes to the protected content.
Can tamper evidence prove who changed a document?
Usually not by itself. It can show that the document changed, but identifying the person responsible may require access logs, version histories, audit records, authentication data, or other evidence.
Does tamper-evident mean legally valid?
No. Tamper evidence can strengthen the reliability of a document, but legal validity depends on the transaction, signing method, evidence, applicable law, and jurisdiction. This information is educational and is not legal advice.