Verify signature
Check a signed PDF, including whether the signature covers the whole file.
This tool runs entirely in your browser. Your file is never uploaded, and you can verify that in your browser's network tab. Verify it yourself: open your browser's network tab and watch. You will see one small request asking whether you have tasks left - a tool name and a hash, never the file.
What this does
This checks the digital signatures inside a PDF and writes a report. It asks four separate questions and never collapses them into one tick: does the signature cover the whole file, does the digest still match, does the signature verify against the certificate embedded with it, and is that certificate one you should trust. The last is answered honestly - there is no trust store here, so the report says not checked.
Whenever a signed document matters and you did not produce it: an invoice that claims to be signed, a contract returned by a counterparty, a certificate sent as proof of something. It is also worth running on your own output, to see what the recipient's reader will report.
How it works
- Drop the signed PDF onto this page.
- Leave certificate details on to see the subject, the issuer, the validity dates and the serial number in the report.
- Press Verify signature. A document with no signature field says so plainly and points you at Digital signature, rather than reporting a failure.
- Read the report. Each signature gets its own section, and every line is marked ok, information, warning or danger.
- Keep the report as a web page, or switch the format to JSON under advanced options if something else is going to read it.
The check most verifiers skip is whether the signature covers the whole file. A PDF signature covers only the byte ranges named in its /ByteRange array, so a forged document can carry a perfectly valid signature over the first two pages and an appended third page that nobody signed. A verifier that asks only whether the CMS validates reports that as signed and intact, which is why it is the first line of this report.
Certificate trusted: not checked is the honest answer, and it is deliberate. Deciding whether a certificate belongs to whoever it names requires a trust store and, for revocation, a call to the issuer - and this tool ships no trust store and contacts no issuer. So the report shows the subject, the issuer and the validity window and asks you to compare them against what you expected.
Read the four lines together rather than looking for a verdict. Covers the whole document and document unchanged tell you the bytes are as they were signed; signature verifies tells you the private key matching the embedded certificate produced it. An expired certificate is a warning rather than a failure, because a signature made before expiry stays valid - though without a timestamp nothing proves when it was made.
A document signed with a picture of a signature has nothing here to check, and the report says no signature field rather than pretending otherwise. That is not evidence of anything wrong - most everyday signing is done that way - but the file carries no evidence of its own integrity, and no tool can supply that afterwards.
What this tool cannot do
- There is no trust store and no network access, so the report cannot say whether a certificate belongs to whoever it names.
- Revocation is not checked. A certificate revoked after it was issued verifies here exactly like one that was not.
- Timestamp tokens are not validated, so any signing time shown is the signer's claim rather than evidence.
- A drawn or scanned signature image carries nothing cryptographic to check; only certificate-based signatures produce a report.
Questions people ask
- What does this actually check?
- Four things, reported separately: whether the signed byte range covers the whole file, whether the document's digest still matches, whether the CMS signature verifies against the certificate embedded with it, and what that certificate says. Each gets its own line and severity, because collapsing them into one verdict is what lets a bad signature look good.
- Why does it say the certificate is not trusted?
- It says not checked, which is a different statement. Checking trust means comparing the certificate against a store of authorities and asking the issuer whether it has been revoked, and both need a network this tool does not use. Compare the subject and issuer against what you were expecting.
- What does it mean when a signature does not cover the whole document?
- That part of the file lies outside the signed byte range - content was appended after the signature was applied. The signature over the earlier part can verify perfectly while the added part is unsigned. Treat everything outside the range as unverified, whatever the signature says about the rest.
- The PDF has a signature on the page but the report says there is none. Why?
- Because it is a picture, not a signature. An image of a handwritten signature is ordinary page content with nothing cryptographic behind it, so there is nothing to verify. That is fine for most paperwork, but the file cannot tell you whether it was altered after signing.
- Is the document uploaded to verify it?
- No. Verification runs in a Web Worker in your browser, and no certificate authority is contacted - which is also why trust is left unanswered rather than asserted. The report you download was generated on your own machine.