PDF Signature Checker
Inspect a PDF for digital signatures: signer, issuer, the whole certificate chain, and whether they cover the entire file. 100% in your browser, no upload.
Drop a PDF here or click to browse
Hand over a root or intermediate certificate — .pem, .crt, .cer or .der — and a path is built from the signer up to it, here, with no network. Revocation (OCSP/CRL) is still not checked: that is the half that needs to reach the issuer.
🔒 The PDF is parsed entirely in your browser — nothing is uploaded.
Inspect PDF digital signatures in your browser
Drop a signed PDF and this tool locates each signature dictionary, decodes the embedded PKCS#7 / CMS (CAdES) blob, and lays out every certificate the file carries — the signer's and the ones that issued it — with each name split into its parts (common name, organization, organizational unit, locality, state or province, country, email) rather than one run-together CN=…, O=… string. Alongside them come the signing time, the digest algorithm, each certificate's serial and validity window, and what the signature dictionary declares about itself: the reason it was signed, the location, the name typed in, and contact details. It also reads the ByteRange to tell you whether the signature covers the whole file or whether content was appended afterwards.
Has the document been changed since it was signed?
Yes — that part is answered. The signature covers a range of bytes in the file you dropped, so hashing those bytes and comparing them against the signed digest needs nothing but the file itself, and it is done here, in your browser. You get one of three answers per signature: nothing has changed, something has changed, or the signature could not be checked at all — never a guess dressed up as a verdict.
What it does not do
Two things about the certificate are plain arithmetic and are answered right here: whether it had already expired at the moment the signature says it was made, and whether it is self-signed — issued by itself, so no other authority vouches for the identity. What is not answered is whether the signer is who they claim to be. Revocation (OCSP/CRL) needs the issuer over the network, so it is never checked. The chain is checked here, without the network, but only against a root or intermediate certificate you supply under Check against a root you trust; with nothing supplied, the signer and issuer names are reported as what the certificate claims, and nothing more. Everything runs locally and your PDF never leaves your device.
Frequently asked questions
Does this tell me the document has not been tampered with?
Yes, for the bytes the signature covers. Those bytes are hashed and compared against the signed digest, right here in your browser, and you are told plainly whether anything changed, whether it did not, or whether the check could not be run. Read that together with "covers the whole document": a signature can be intact and still not protect content appended after it.
Does this prove the signer is who they claim to be?
No — that is the other half of the question, and it needs the issuing authority. Revocation (OCSP/CRL) needs the issuer over the network, which this tool never contacts, so it is not checked, and a certificate can chain perfectly and still be revoked. The chain itself can be checked here, without the network, against a root or intermediate you supply under Check against a root you trust. With nothing supplied, treat the signer and issuer names as what the certificate claims.
Why does it list more than one certificate?
A signature normally ships a small bundle: the certificate that signed, plus the ones that issued it, up towards a root. All of them are listed, with the signing one marked, because who vouched for whom is half of what a certificate says — and each is shown with its own validity window, serial number, and whether it is self-signed. None of them is checked against a trusted root unless you supply one under Check against a root you trust; that check runs here without the network, and revocation is never checked.
What does "covers the whole document" mean?
A PDF signature signs a specific byte range. When that range spans from the start to the end of the file, the signature protects the entire document. If bytes were appended later in an incremental update, the signature does not cover those newer bytes, and this tool flags it.