Verify a PDF's digital signature in your browser
See who signed it, whether anything changed after signing, and how far the certificate can be checked. The PDF stays on your device.
Drop a signed PDF, or click to choose
The check runs on your device. The PDF is not uploaded.
What this checks, and what it does not
A digital signature in a PDF is a block of cryptographic data stored inside the file. It records which bytes were signed, a fingerprint (hash) of those bytes, the signer's certificate, and a signature value that only the signer's private key could have produced. This tool reads that block and checks it on your device.
- Integrity. It hashes exactly the bytes the signature says it covers and compares the result with the fingerprint inside the signature. One changed byte is enough to fail.
- The signature itself.It verifies the signature value with the public key in the signer's certificate. RSA and ECDSA signatures with SHA-1, SHA-256, SHA-384 and SHA-512 are supported.
- Later changes. It tells you whether anything was added to the file after each signature, and checks every signature in signing order.
- The certificate chain.It follows the signer's certificate up through each issuer included in the file and checks that every issuer really signed the certificate below it. It shows the signer, issuer, serial number, validity dates and fingerprints.
It does not check revocation (whether a certificate was cancelled before its expiry date), which needs live lookups to the issuer. It ships no built-in list of trusted authorities, so on its own it never claims a signer is who their certificate says. You can build your own list, as desktop PDF readers let you: trust a certificate from a signature's details, or add a certificate file, and signatures that lead to it show a green tick marked “Trusted by you”. It does not judge legal validity, which depends on where you are and who you are dealing with.
Why a signed PDF says “validity unknown”
PDF readers check a signature in layers. First, is the document unchanged since it was signed? Second, does the signature verify? Third, does the signer's certificate lead back to an authority the reader already trusts? “Signature validity is unknown” and “At least one signature has problems” usually mean the first two passed and the third did not: the file is intact and the signature is genuine, but your reader does not know the authority that issued the signer's certificate.
That happens when the issuing authority is not on the reader's built-in trust list, the trust list on your computer is out of date, or a revocation check could not reach the network. It is not the same as a forged signature. A forged or edited document shows up as changed or invalid, which is the result to worry about. To clear the message in your reader, open the signature properties, look at the signer's certificate, and add its root to your trusted certificates only if you know that root is genuine.
Trusting a certificate
Desktop PDF readers keep a list of certificates you trust, and show a green tick on signatures that lead back to one of them. This tool works the same way. Open “Certificate details and trust” under a signature and choose “Trust this certificate” on the signer's certificate or on any certificate above it. Trusting the root of an organisation's certificates covers every signer it issued; trusting one signer's certificate covers only that signer.
The list is saved in this browser only, never uploaded, and you can remove a certificate at any time, or export the list as a .pem or .json file and import it in another browser. A signature gets the green tick only when its content is unchanged and every certificate on the way to the one you trust was valid when it was signed. A changed document, a broken chain, or an expired certificate never gets it. Trust a certificate only when you know it is genuine, for example by checking its SHA-256 fingerprint with the sender. “Trusted by you” records your decision; it is not an official or legal approval.
Reading the result
| Result | What it means | Should you worry? |
|---|---|---|
| Signature intact, Trusted by you | The signed bytes are unchanged, the signature verifies, and the signer's certificate leads to a certificate you chose to trust, valid when it was signed. | Only as much as you trust that certificate. It is your own setting in this browser, not an official approval. |
| Signature intact | The signed bytes are unchanged and the signature verifies with the signer's certificate. | Not about the content. Still decide whether you trust the signer. |
| Intact, file added to later | What was signed is unchanged, but something was added afterwards: another signature, form entries, comments, or other edits. | Usually normal for a document signed by several people. Look at what the later signatures cover. |
| Changed after signing | The content this signature covers no longer matches what was signed. | Yes. Do not rely on this document without getting a fresh copy from the sender. |
| Does not verify | The signature value does not match the signer's certificate, or the signature is damaged. | Yes. Treat it as unsigned. |
Under each verdict you also see whether the signer's identity was verified. Without a certificate you chose to trust, it reads “Signer identity not verified against a trusted authority”. A certificate chain that ends at a root included in the file proves nothing about identity on its own, because anyone can create such a root.
It runs in your browser, nothing is uploaded
Signed PDFs are often contracts, certificates, statements and letters you would not hand to a stranger. Many online validators ask you to upload the file to their server. This page reads the PDF in your browser, hashes it with the browser's built-in Web Crypto, and shows the result. The PDF and its name are never sent anywhere. A desktop PDF reader also checks locally; the difference here is no install and a plain explanation of each result.
This tool
Checks on your device. No upload, no account, works for any number of signatures in one file.
Most online validators
Upload the document to a server to check it, then show the result in the page.
Signature formats it reads
PDF signatures stored as CMS / PKCS#7 data, which covers the common adbe.pkcs7.detached and PAdES (ETSI.CAdES.detached) formats, the older adbe.pkcs7.sha1 format, and RFC 3161 document timestamps. Timestamps embedded inside a signature are checked too, and when one verifies its time is shown as the signing time. The rare adbe.x509.rsa_sha1 format is reported as not checked rather than guessed.
Keep the signed original
A signature covers the exact bytes of the file. Tools that save a new copy, such as adding a password to a PDF or merging PDFs, produce a file whose signatures no longer verify. Share the signed original, and if you need a picture of a signed page, save that page as a JPG alongside it.