✅ Verify PDF Signature

Verify a PDF's digital signature and tamper status

✓ Free Forever · ✓ No Signup · ✓ No Upload · ✓ Works Offline

🔒 Your documents never leave your device. All processing happens locally in your browser using Own CMS (PKCS#7) reader + the browser's Web Crypto API; pdf-lib for the document details. No upload, no server, no tracking.

Features

  • Signature Check — Validates each digital signature in the PDF.
  • Tamper Detection — Flags changes made to the PDF after signing.
  • Certificate Details — Shows who signed, when, and by whom the certificate was issued.
  • 100% Private — Runs in your browser — no upload.

How It Works

  1. Upload signed PDF — Drop your file.
  2. Verify — Click Verify — the tool parses the signature and certificate.
  3. Review results — See signature validity, signer info, and tamper status.

Use Cases

  • Verify authenticity of legal contracts
  • Check vendor invoices with signatures
  • Validate signed internal policies

Frequently Asked Questions

What does it actually check?

For every signature: that the signed part of the file still hashes to the value the signer signed (so nothing in it was edited), that the signature really was made with the key in the signer's certificate, who the certificate names and who issued it, its validity dates against the signing time, and any RFC 3161 timestamp. It also tells you whether anything was added to the file after the last signature.

What signature types are supported?

The ones PDF readers use: adbe.pkcs7.detached, ETSI.CAdES.detached (PAdES), adbe.pkcs7.sha1 and ETSI.RFC3161 document timestamps, signed with RSA (PKCS#1 v1.5 or PSS), ECDSA (P-256, P-384, P-521) or Ed25519 where your browser supports it, using SHA-1, SHA-256, SHA-384 or SHA-512. Anything else (MD5, DSA, Ed448…) is named and reported as not checked rather than guessed.

Does "valid" mean I can trust the signer?

No — it means the file wasn't changed and the signature matches the certificate inside it. Anyone can make a certificate with any name on it (the report marks self-signed ones). Whether the issuing authority is trustworthy, and whether the certificate was revoked, needs a list of trusted authorities and an online check with them. A web page has neither, and this one sends nothing anywhere, so Adobe Acrobat Reader is the place for that part.

It says something was added after the last signature. Was the document tampered with?

Not necessarily. PDFs are signed in layers: filling in a form, adding a comment or a second signature, or the validation data some signing tools append, all add bytes after a signature. The signed part itself is checked byte for byte; what came later is reported with its size. Acrobat Reader can show what those later changes were.

Is my PDF uploaded?

No. The whole check runs in your browser; the file never leaves your device.

Notes from Milo 🐨

2026-10-20

Confession: until today this page didn't really verify anything. It counted the signatures and checked whether bytes followed the last one — a contract whose signed text had been edited in place still came back "covers the whole file". Now every signature is checked for real, in your browser: the signed bytes against the digest the signer signed, the signature against the key in their certificate, plus who signed, who issued the certificate, the dates and any timestamp. It also stopped claiming every PDF was "made with pdf-lib" and modified today.

2026-10-02

The result used to be raw JSON in English, and its "changed after signing" check looked at the wrong thing. It's now a plain report in your language, and it checks whether anything was added after the part the last signature covers.

Related Tools

💬 Bug, idea, or just to say hi? Tell Milo 🐨 · [email protected]