How it works
- 01Open the signed PDF.
- 02The panel lists each signature, who it says signed, and when.
- 03Read the verdict: unchanged, altered, or added-to after signing.
- 04Nothing is modified — this tool only reads.
It hashes the document itself
A signature covers a range of bytes and records a hash of them. This reads that range, hashes exactly those bytes, and compares. If they match, the document is byte-for-byte what was signed. That is a real cryptographic check, not a look at a flag in the file.
The trick it is built to catch
A signature covers everything except itself — and anything appended afterwards is not covered either. Add a page to a signed PDF and the original signature still checks out over its own range, while the document in front of you is not the one anybody signed. This reports exactly how many bytes lie outside the signature and says plainly that the two are not the same document.
What it will not tell you
It will not tell you the signer is who the certificate says. Proving that means following the certificate up to an authority you trust and checking it has not been revoked — and revocation checking is a network request that says "I am looking at this document" to a third party. This site does not make requests about your documents, so it does not do that, and it does not pretend to.
Which is why it never says "valid"
Anyone can generate a certificate in any name in about thirty seconds. A document can be genuinely unchanged since signing and signed by something worthless. The two facts are reported separately here — unchanged since signing, and the name the certificate claims — because merging them into one word is how people end up trusting a document they should not.
A picture of a signature is not a signature
Most "signed" PDFs carry an image of someone's handwriting, which is ink on a page and proves nothing — anyone can move it, copy it, or paste it onto another document. If a file has no digital signature this tool says so, which is often the useful answer.
Questions
- What does "could not check" mean?
- The signature is in a format this tool could not read far enough to verify. That is not evidence of tampering — usually it is an unusual producer — but nothing has been confirmed either, and it is reported as its own outcome rather than lumped in with failure.
- Can it check a timestamp from a timestamping authority?
- It shows the signing time recorded inside the signed attributes, which is harder to alter than the one in the plain dictionary. It does not validate a separate trusted timestamp token.
- Can I sign a PDF here?
- Not cryptographically. You can add a visible signature — drawn, typed or an image — with the signing tools, and those pages say clearly that it is not a legal cryptographic signature. Real signing needs a certificate and a trusted timestamp, both of which need a network.
- Does opening the file here break the signature?
- No. This tool changes nothing. Be aware that exporting from any editor rewrites the document and will invalidate a signature — that is true of every PDF editor, and is the point of signatures.