Verify PDF signature
Someone sent you a signed PDF. This tells you whether the file still matches what was signed, and who the certificate says signed it. The document is read here on your device; a signed contract is the last thing you should have to upload to a stranger.
Drop a PDF here, or click to choose
Your file stays on this device. Nothing is uploaded.
How to check a PDF's digital signature
- Drop the signed PDF onto the box above, or press “Choose a PDF file”. Checking starts straight away.
- Read the verdict at the top. It tells you whether the file was altered after signing, or whether the signature could not be checked.
- Read each signature's card for when it was signed, which part of the file it covers and whether the certificate was valid. Who the certificate belongs to cannot be confirmed in a browser, and the page says so.
What Verify PDF signature does
Somebody sends you a contract, an invoice or a certificate as a signed PDF. This answers the two questions worth asking about it: has anything changed since it was signed, and who does the certificate say signed it.
What it does
- Recomputes the document's fingerprint and compares it with the one sealed inside the signature
- Checks the signature itself against the signer's certificate, so a forged one is caught even when the text is untouched
- Separates the two ways a signed file goes wrong: content edited, or content added after the signed part
- Shows who the certificate names, who issued it, when it expires, and whether the signer issued it to themselves
- Says plainly which checks it could not do, rather than showing a tick that means less than it looks
What it does not do
- Confirm that the certificate really belongs to the person it names; that needs the trusted-authority list your operating system holds, which a web page cannot read
- Check whether a certificate has been revoked, which needs a request to the issuer's server that a browser is not permitted to make
- Report on a drawn or scanned signature, which carries no certificate and so has nothing to verify
- Tell you whether a signature is legally sufficient where you are; that depends on the document and the jurisdiction
- Change the file in any way; it only reads
Last updated
Need to send this to someone?
Our sister site QRSansar hosts a document and gives you a short link and a QR code for it. That is handy for WhatsApp, a slide, a poster or a printed handout, and it avoids attachment size limits entirely. You can swap the file later and the link and QR code keep working.
Worth being clear about the difference: that is a hosting service, so your file is uploaded to it. Everything on PDFsansar stays on your device; sharing is the one job that cannot.
Share a document on QRSansar →Other tools
All free, and all run in this tab without uploading anything.
Verify PDF signature: common questions
What does “the document has not changed” actually prove?
That the bytes covered by the signature are the same bytes that were signed. A signature carries a fingerprint of the file taken at the moment of signing; this recomputes that fingerprint and compares. If they match, nobody has altered a word, a figure or a page since. If they do not, something changed after signing, and the tool says which of the two ways it changed: the content was edited, or extra content was added to the end.
It says the signature is valid but the signer is unverified. Which is it?
Both, and they answer different questions. “Valid” means the maths works: the signature really was made with the private key belonging to the certificate inside the file, and the document matches. “Unverified” means we cannot tell you that the certificate belongs to the person it names. Checking that needs the list of certificate authorities your operating system trusts, and a browser page is not allowed to read it. Acrobat can do that check; this cannot, so it says so instead of guessing.
The certificate is self-signed. Is the document fake?
Not necessarily, and the distinction is worth understanding. Self-signed means whoever signed it issued their own certificate rather than buying one from an authority. The tamper detection still works perfectly, so you can be sure the file has not changed. What you cannot be sure of is who made it, because anybody can generate a certificate with any name on it. Treat a self-signed signature as a seal on an envelope: it tells you the envelope has not been opened, not who sealed it.
Why does it say the signature does not cover the whole file?
Because bytes exist after the end of the signed range. In a PDF that is how a document gets extended after signing: someone appended pages, a form entry or another change, and it sits outside what the signature guarantees. Sometimes that is innocent: a second person counter-signing adds their own section, and the tool recognises that case and does not flag it. When nothing else accounts for the extra bytes, be suspicious of them.
Can it check when the document was signed?
It shows the signing time, and it also tells you whether that time is backed by a timestamp from an independent authority. Without one, the date is simply what the signer's computer claimed at the time, and a claim is not proof. A clock can be set to anything. Timestamps have to be fetched from a server while signing, so plenty of otherwise fine signatures do not have one.
My PDF has a signature on it but this says it is not signed.
Then it is a picture of a signature rather than a cryptographic one, which is what most signed PDFs contain, including the ones our own Sign PDF tool makes. A drawn or scanned signature is ink on the page; it is widely accepted and it carries no certificate, so there is nothing here to check. This tool only reports on the cryptographic kind.