Validate Signature
Check the digital signatures in a PDF: whether the document changed after signing, who the certificate names as signer, and when.
About This Tool
Validate Signature checks the digital signatures in a PDF: whether the signed content has changed since it was signed, who the certificate says signed it, and when. It reads signatures made by other software as well as this site's own: RSA in both of its forms, ECDSA on the standard curves, the two older Acrobat formats, and document timestamps.
Each signature gets one of three results. Verified means the signed content is unchanged and the signature was made with the key in its certificate. Not valid comes with its reason: the document was changed after signing, the signature was not made with that certificate's key, or the file has room in it for content that nobody signed. Could not be checked means the signature uses a method this browser does not support, and says nothing about the document. A "More was added after it" mark means something was added to the file after that signature: a later signature does this, and so does a later edit. To confirm who signed, add a certificate you already trust and the tool checks that the signature chains to it.
All validation happens locally in your browser. Your documents are never uploaded to any server.
How to Use
Upload Signed PDF
Choose a PDF document that contains digital signatures.
Read the Result
Each signature is listed with its result: verified, not valid with the reason, or could not be checked. A timestamp in the file is listed as a timestamp.
Check Details
See the signer named in the certificate, who issued it, its validity period and the signing time.
Confirm the Signer
Optionally add a certificate you trust to check that the signature really chains to it.
Use Cases
Document Verification
Check that a signed document has not been changed since it was signed.
Compliance Audit
Review the signatures on documents kept for compliance and audit purposes.
Certificate Review
View certificate details and expiration dates for signed documents.
Frequently Asked Questions
What does "verified" mean?
The content covered by the signature is exactly what was signed, and the signature was made with the key in the certificate it carries. If the signature also carries the "More was added after it" mark, something was added to the file after it, and this signature says nothing about that part; the page says how much was added. On its own, verified does not prove who the signer is: a self-signed certificate can carry any name. Add a certificate you trust to check that.
Why might a signature be not valid?
The page gives the reason. The document was changed after it was signed, or the signature was copied from a different document. Or the signature was not made with the key in the certificate beside it. Or the part of the file that the signature leaves out, which should hold the signature and nothing else, holds something more: a file built that way can show content nobody signed. A file that was cut short is not valid either.
Why can some signatures not be checked?
The arithmetic is done by your browser, so the tool checks what the browser can: RSA in both of its forms and ECDSA on the standard curves, with SHA-1, SHA-256, SHA-384 or SHA-512. A signature made another way, as some national schemes and rarer curves are, is reported as could not be checked, with the method named, rather than guessed at. So is a signature that does not carry its signer's certificate.
Does an expired certificate make a signature invalid?
No. The tool shows the certificate's validity period and says whether the certificate was in date at the time the signature gives. That time comes from the signer's own computer unless the file carries a timestamp. The tool does not ask the issuer whether a certificate was revoked.