PDF Signature Checker
Check a PDF's digital signatures — see each signer's certificate (subject, issuer, validity), when it was signed, and whether the document still matches the digest that was actually signed (tamper detection). Parsed entirely in your browser; the file is never uploaded.
Input
Reads embedded /Sig dictionaries locally in your browser — the file is never uploaded.
Output
Signatures
| # | Signer | Issuer | Signed At | Format | Integrity |
|---|---|---|---|---|---|
| No data yet | |||||
Certificate Details
| Signature # | Field | Value |
|---|---|---|
| No data yet | ||
Warnings
| Signature # | Severity | Message |
|---|---|---|
| No data yet | ||
Guides
A digitally signed PDF embeds one or more /Sig dictionaries: a /ByteRange marking exactly which bytes of the file were signed, and a /Contents value holding a PKCS#7 (CMS) SignedData structure — the signer's X.509 certificate plus a cryptographic digest of those bytes. This tool reads that structure directly in your browser: who signed the document (and who issued their certificate), when it was signed, and — the part most PDF signature viewers skip — whether the file's current bytes still match the digest that was actually signed.
How to use it
- Upload a signed PDF.
- Every signature found is listed in the Signatures table: signer, issuer, when it was signed, the signature format, and an integrity verdict.
- Certificate Details breaks out each signature's certificate — subject, issuer, validity window, serial number, key size — one block per signature.
- Warnings flags anything worth a second look: a self-signed certificate, a weak RSA key (under 2048 bits), a weak digest algorithm (SHA-1/MD5), a certificate that wasn't valid yet (or already expired) at the moment it signed, or — most importantly — a document that no longer matches its signed digest.
What "Integrity" means here
Each signature's /ByteRange bytes are re-hashed locally and compared against the messageDigest the signer actually signed (found in the PKCS#7 SignedData's authenticated attributes):
- Intact — the file's covered bytes still hash to exactly what was signed. Nothing in the signed range has changed since signing.
- Modified after signing — the current bytes don't match. Something in the signed range was edited, appended, or corrupted after the signature was applied.
- Could not verify — the signature doesn't carry a signed digest attribute (an older, non-CAdES format) or uses a format this tool doesn't parse (the legacy pre-PKCS#7
adbe.x509.rsa_sha1).
A PDF can carry more than one signature (e.g. certified + counter-signed, or signed by multiple parties) — each is checked and reported independently.
Privacy
Everything runs client-side: the file is parsed entirely in your browser and never uploaded to a server.
Does this prove the signature is trustworthy?
No — "Integrity" here confirms the document hasn't changed since it was signed, not that you should trust the signer. This tool does not cryptographically verify the PKCS#7 signature against the certificate's public key, and it does not build a trust chain to a root CA (there is no certificate authority bundle in a browser to check against). It reads and reports what's embedded in the file, the same way a certificate decoder reads a certificate's fields without validating who issued it. For a legally significant document, verify the signature in dedicated software (e.g. Adobe Acrobat) that has access to a trusted CA store.
What if no signatures are found?
The file either isn't digitally signed, or its /Sig dictionaries couldn't be located — this tool scans the raw PDF bytes for /ByteRange//Contents markers rather than parsing the full PDF object model, which covers the signatures produced by essentially every signing tool (Adobe Acrobat, DocuSign, open-source signers) but can, rarely, miss a non-standard structure.