When a PDF is created, the program that creates it writes a /Producer entry into the PDF's info dictionary. Adobe Acrobat, Word's "Save as PDF", pdfTeX, Chrome's print-to-PDF, Google Docs export, and AI tools that emit PDFs all leave a fingerprint here. Most users never see the field. It's one of the highest-signal-per-byte fields in PDF forensics.
This page covers what the common values mean and how to read them.
How to inspect the field yourself
In any PDF viewer:
- Adobe Acrobat / Reader: File → Properties → Description tab → "PDF Producer".
- Preview (macOS): Tools → Show Inspector (⌘I) → first tab.
- Chrome: open the PDF, right-click → Document Properties (in some versions).
- Command line:
pdfinfo file.pdf(from poppler-utils) prints it directly.
Or just drop the file into forensics.autotend.io and the report surfaces it inline.
Common Producer values
Microsoft-origin
Microsoft® Word 2019/Microsoft® Word for Microsoft 365/Microsoft Word 2016— Word's native "Save as PDF" export. Reliable signal that the document was authored in Word.Microsoft: Print To PDF— the Windows print-to-PDF driver, invoked from any application. Tells you a printable preview was captured but not the originating application.Word Online/OneDrive Print Service— Word in the browser exported the PDF. Different upstream chain than desktop Word.
Google-origin
Skia/PDF m120 Google Docs Renderer— Google Docs' built-in PDF export. The "Skia" string is the rendering library; "Google Docs Renderer" is the explicit name. Version numbers (m120,m118) update as Chrome's Skia version updates.Skia/PDF mNNN(no Google Docs Renderer) — Chrome's print-to-PDF dialog. The user opened a webpage, hit print, chose "Save as PDF". Could be anything visible in a browser.
LaTeX / academic-format-origin
pdfTeX-1.40.21/XeTeX 0.9999.../LuaTeX-1.10.0— the document was authored in LaTeX. Strong signal for STEM coursework. Producer typically pairs with a/Creatorfield likeTeX output 2026.05.12:1430.
macOS-origin
Quartz PDFContext— the macOS print-to-PDF system. Pages, TextEdit, Preview, Safari, anything on macOS that prints can produce this. The application that triggered it is recorded separately in/Creator.
Adobe-origin
Adobe PDF Library NN.N— Acrobat exported or re-saved this. Often the second pass — someone took a PDF from somewhere else and opened/saved it in Acrobat. Worth checking the/Creatorand/CreationDateto figure out the upstream chain.
LibreOffice / Pages / OpenOffice
LibreOffice 7.x— LibreOffice's native export. Common on Linux and frugal users.Pages 13.x/Pages 12.x— Apple's Pages exported to PDF. Less common in student work; more common in K-12 contexts.
Scanner / OCR-origin
Adobe Scan Mobile/iOS Scanner/CamScanner— the file is a photographed scan, possibly with OCR. Very different forensics shape from an authored PDF.
AI-tool-origin (worth specific attention)
iText/iTextSharp/PyMuPDF/pdfkit/wkhtmltopdf/Puppeteer— these are programmatic PDF generators. They appear when:- An AI tool emitted a PDF directly (some LLM "study generator" tools do this).
- A script or web service converted some other format to PDF.
- The student exported from a niche tool that uses one of these libraries.
Skia/PDFwith no Google Docs Renderer string AND a/Creatormentioning a tool name — this is the print-to-PDF flow, but worth checking what the Creator names.
These programmatic Producers don't mean "AI"; they mean "not directly exported from a normal word processor." The student might have a perfectly innocent explanation; ask before concluding.
Suspicious / empty / generic
(Producer absent)— some PDF tools strip metadata. Worth noting.Producer:— empty string. Same.Distiller— old Adobe PostScript-to-PDF conversion path. Unusual in modern student submissions.
What Producer can't tell you
- It can't tell you whether the visible content was written by a human. A PDF with
Producer: Microsoft Wordcan carry AI-generated text the student copy-pasted in. The PDF metadata only tells you about the PDF-creation step, not the writing. - It can't tell you the document's age. PDFs can be re-saved years later with no change to Producer.
- It can't catch a clever spoof. The field is a string in the file; programs that generate PDFs can write anything they want there. Most don't.
How this fits with other PDF signals
The Producer field is one piece of the PDF metadata stack. Other relevant fields:
/Creator— the upstream application name (e.g. "Microsoft Word" withProducer: Microsoft Print to PDF)./CreationDateand/ModDate— when the PDF was created and last modified. Compared against the submission timestamp, these can flag "PDF created 30 seconds before submission, modified 5 seconds after."/Title,/Author,/Subject,/Keywords— Dublin-Core-like fields, often empty in student submissions.- XMP metadata — a parallel metadata block, sometimes carrying additional fields like a hidden
pdf:Producerthat doesn't match the visible one.
When the /Producer and XMP pdf:Producer disagree, that's a strong "this file passed through more than one program" signal — worth a closer look.
What Autotend Forensics surfaces
The scoring engine reads /Producer, /Creator, and the XMP block. Notable detection patterns:
- Programmatic Producer (iText, PyMuPDF, wkhtmltopdf, etc.) is flagged as a low-severity timeline/origin observation.
- Producer ↔ XMP mismatch is a structural signal.
- Producer = "Adobe PDF Library" combined with no other authoring trace suggests a re-save chain worth investigating.
None of these is a verdict. They're observations that surface in the scan report along with the structural-shape signals.
Bottom line
Producer is one of the highest-leverage single fields you can check in a PDF submission. It won't answer the authorship question alone, but it narrows the conversation a lot. The full PDF deep-dive — including the structural anomalies that complement metadata — is on the PDF format methodology page.