PDF Signature Checker

A digitally signed PDF embeds one or more /Sig dictionaries: a /ByteRange marking exactly which bytes of the file were signed, and a /Contents value holding a PKCS#7 (CMS) SignedData structure — the signer's X.509 certificate plus a cryptographic digest of those bytes. This tool reads that structure directly in your browser: who signed the document (and who issued their certificate), when it was signed, and — the part most PDF signature viewers skip — whether the file's current bytes still match the digest that was actually signed.

How to use it

1. Upload a signed PDF.
2. Every signature found is listed in the Signatures table: signer, issuer, when it was signed, the signature format, and an integrity verdict.
3. Certificate Details breaks out each signature's certificate — subject, issuer, validity window, serial number, key size — one block per signature.
4. Warnings flags anything worth a second look: a self-signed certificate, a weak RSA key (under 2048 bits), a weak digest algorithm (SHA-1/MD5), a certificate that wasn't valid yet (or already expired) at the moment it signed, or — most importantly — a document that no longer matches its signed digest.

What "Integrity" means here

Each signature's /ByteRange bytes are re-hashed locally and compared against the messageDigest the signer actually signed (found in the PKCS#7 SignedData's authenticated attributes):

• Intact — the file's covered bytes still hash to exactly what was signed. Nothing in the signed range has changed since signing.
• Modified after signing — the current bytes don't match. Something in the signed range was edited, appended, or corrupted after the signature was applied.
• Could not verify — the signature doesn't carry a signed digest attribute (an older, non-CAdES format) or uses a format this tool doesn't parse (the legacy pre-PKCS#7 adbe.x509.rsa_sha1).

A PDF can carry more than one signature (e.g. certified + counter-signed, or signed by multiple parties) — each is checked and reported independently.

Privacy

Everything runs client-side: the file is parsed entirely in your browser and never uploaded to a server.

Does this prove the signature is trustworthy?

No — "Integrity" here confirms the document hasn't changed since it was signed, not that you should trust the signer. This tool does not cryptographically verify the PKCS#7 signature against the certificate's public key, and it does not build a trust chain to a root CA (there is no certificate authority bundle in a browser to check against). It reads and reports what's embedded in the file, the same way a certificate decoder reads a certificate's fields without validating who issued it. For a legally significant document, verify the signature in dedicated software (e.g. Adobe Acrobat) that has access to a trusted CA store.

What if no signatures are found?

The file either isn't digitally signed, or its /Sig dictionaries couldn't be located — this tool scans the raw PDF bytes for /ByteRange//Contents markers rather than parsing the full PDF object model, which covers the signatures produced by essentially every signing tool (Adobe Acrobat, DocuSign, open-source signers) but can, rarely, miss a non-standard structure.