Vellum finds every signature field in a PDF and reports, for each one, the signer’s name and organisation as read from the certificate, the issuing authority, the certificate’s validity window, the signing time recorded in the document and, when present, the RFC 3161 timestamp with the timestamp authority’s name, along with the digest algorithm used. The tool checks whether the cryptographic signature matches the signed byte range — in other words, whether the document stayed intact for that signature — and flags whether bytes were added after that range, which means the document was modified after signing through an incremental update, never described as tampering. The signature profile is stated too: PAdES or the legacy PKCS#7 format. Honest limitation: a browser has no trust store, so the certificate chain cannot be validated against a list of recognised authorities — the tool then reports that the chain could not be verified, never that it is invalid. The whole computation happens on your device, with no file sent anywhere.
The tool recomputes the cryptographic hash of the part of the document covered by the signature and compares it with the value stored in the signature itself. If the two hashes match, the signed content has not changed since signing; if they differ, the document no longer corresponds exactly to what was signed.
A PDF can be extended without destroying an existing signature: a second signature, a filled-in form field, an added annotation. It means the file is no longer byte-for-byte identical to what was signed, without that by itself indicating anything improper. The original signature stays valid for the part of the document it originally covered.
A browser has no trust store comparable to Acrobat’s or an operating system’s. Vellum reports that the certificate chain could not be verified against a list of recognised authorities, and never states that the certificate is invalid. You can check the displayed issuer name yourself, or open the document in Acrobat Reader, which applies its own trust list.
No, the whole verification — reading the signatures, computing the hashes, checking the signed range — runs in your browser, on your device. The file is never sent to a server.
PAdES (ETSI.CAdES.detached) is the current signature format, standardised for PDF; adbe.pkcs7.detached is the older format, still found on older documents but gradually being phased out. An RFC 3161 timestamp, when present, provides independent proof of the date on which the signature already existed, issued by a third-party timestamp authority rather than the clock of the signing computer.
"Unknown issuer" only means that the authority that issued the certificate is not recognised by any trust list the tool consults; compare the displayed name with the one you expected, or open the file in Acrobat Reader for a second opinion. Any PDF can be checked; a password-protected file must first be unlocked with the "Unlock a PDF" tool.
Vellum — free PDF tools whose processing stays on your device.