Validate PDF Signature

Verify digital signatures in your PDF files. Check certificate validity, view signer details, and confirm document integrity. All processing happens in your browser.

Click to select a file or drag and drop

PDF Documents

Your files never leave your device.

What Signature Validation Tells You

Opening a signed PDF and seeing a signature icon does not mean the signature is good. Readers differ in how loudly they complain, and a document whose signature was invalidated by a later edit can still look perfectly ordinary. Validation means actually parsing the embedded signature, extracting the certificate it used, and checking what it covers.

This tool reads every signature in the file and reports who signed it, which authority issued the certificate, when that certificate is valid, and - crucially - what portion of the document the signature covers. A signature that covers the whole file and one that only covers the first revision are very different things, and the difference is invisible in a normal viewer.

It also flags signatures that rely on weak digest algorithms such as MD5 or SHA-1. Those are still found in older documents and are no longer considered trustworthy, even though the arithmetic still checks out.

Questions validation answers

  • Who signed it?: the common name and organisation from the signer certificate
  • Which authority vouched for them?: the issuing certificate authority in the chain
  • Was the certificate valid then?: the validity window, and whether it has since expired
  • Does the signature still cover the file?: whether the whole document or only earlier revisions are protected
  • Is the algorithm still acceptable?: MD5 and SHA-1 digests are called out as insecure

Key Features

  • ✓ All signatures listed
  • ✓ Certificate details
  • ✓ Validity window shown
  • ✓ Coverage status
  • ✓ Weak digest detection
  • ✓ File never uploaded

How to Validate a PDF Signature

1

Upload the signed PDF

Select the document. It is parsed locally in your browser; nothing is transmitted.

2

Optionally add a trusted certificate

Supply a certificate you already trust to see whether signatures chain back to it. This is how you confirm a signature was made by a specific organisation.

3

Read the results

Each signature is listed with its signer, issuer, validity dates, coverage status and any cryptographic concerns.

Reading the Results

What the fields mean

  • Signer: the name on the certificate that made the signature
  • Issuer: the certificate authority that vouched for the signer
  • Validity: the window during which the certificate was usable
  • Coverage: whether the signature protects the whole file or only part of it
  • Algorithm: the digest and signature algorithms the signature uses

Common ways a signature looks bad

  • The document was edited after signing, so coverage is only partial
  • The certificate has expired and no timestamp was added
  • The signer used a self-signed certificate, so no authority vouches for it
  • The signature relies on MD5 or SHA-1 and is no longer trustworthy

Frequently Asked Questions

It tells you what the signature says and whether it is cryptographically intact. Whether you should trust the signer depends on whether you trust the certificate authority that issued their certificate - the tool shows you which one it is so you can judge for yourself.
PDF signatures cover a specific byte range. If someone edits the document after signing, the file grows but the original signature can only vouch for the earlier revision. Validation reports this as partial coverage, which is the main way a tampered document gives itself away.
Yes. The certificate travels inside the signed PDF, so the tool can read the signer, issuer and validity dates from the file alone. Supplying a certificate you already trust is optional, and only needed when you want to check that the chain leads to the right root.
If the signature carries a trusted timestamp - see our Timestamp PDF tool - then the moment of signing is fixed before the expiry, and the signature stays valid indefinitely. An expired certificate with no timestamp is the case that causes real problems.
No. Parsing happens in your browser with WebAssembly, so confidential contracts stay on your machine. This matters here more than almost anywhere, since the documents you validate are usually the sensitive ones.
Older signatures used MD5 or SHA-1 to compute the hash that gets signed. Both have practical collision attacks, so a document could in principle be altered while keeping the same hash. Modern signatures use SHA-256 or stronger, and the tool flags the old ones.
No. If the byte structure is broken badly enough that the signature object cannot be parsed, there is nothing to validate. Try the Repair PDF tool first, though a repair usually changes bytes and will invalidate any signature it recovers.
The reader shows a badge; this shows the data behind it. You get the signer and issuer names, the exact validity window, the serial number, the algorithms, and which part of the document is covered - the details you need when the answer actually matters.

Related PDF Tools

Sign PDF with Certificate

Apply an X.509 signature

Timestamp PDF

Attach a trusted timestamp

Repair PDF

Try to recover a file

Flatten PDF

Lock the visual content

Compare PDFs

Spot differences between versions

Sanitize PDF

Strip hidden metadata

PDF Editor

Inspect a suspicious file

Extract Pages

Isolate a signed page

Compare PDFs

Spot post-signing edits