Check a signature
See what a signature actually guarantees — nothing is changed.
Your files never leave your deviceDrop the PDF you want to check
Nothing is modified: this report only reads the document.
How to check a PDF’s signature, step by step
This read-only report recomputes the digest of every cryptographic signature in a PDF and compares it to the one sealed in the file, without ever changing it.
Drop the PDF to check
Drag the file in, or click to browse for it. The analysis runs right away in your browser.
Read the verdict for each signature
“Document intact”, “Modified after signing”, “Undetermined” or “The signed content has changed” — each verdict comes with a plain-language explanation.
Look at the certificate details
Signer, issuer, validity, serial number and the algorithms used are shown for each signature, along with the certificate chain included in the file.
Check the timestamp, if there is one
When an RFC 3161 timestamp is present, its date and its link to the signature are shown separately from the date merely declared by the signer.
Read the notes on trust and revocation
At the bottom of the report, two notes explain what this check cannot tell you — never showing red unless it’s mathematically proven.
A browser has no trust store: VellumPDF therefore cannot say whether the certificate’s issuer is recognized, nor check its revocation (CRL, OCSP). That does not make the certificate invalid — check the issuer’s name yourself, or open the document in Acrobat Reader, which applies its own list.
Frequently asked questions
How do I know whether a signed PDF has been altered since it was signed?
The tool recomputes the cryptographic hash of the part of the document covered by the signature and compares it with the value stored in the signature itself. If the two hashes match, the signed content has not changed since signing; if they differ, the document no longer corresponds exactly to what was signed.
What does "Modified after signing" mean?
A PDF can be extended without destroying an existing signature: a second signature, a filled-in form field, an added annotation. It means the file is no longer byte-for-byte identical to what was signed, without that by itself indicating anything improper. The original signature stays valid for the part of the document it originally covered.
Why can’t VellumPDF tell me the certificate is trustworthy?
A browser has no trust store comparable to Acrobat’s or an operating system’s. VellumPDF reports that the certificate chain could not be verified against a list of recognised authorities, and never states that the certificate is invalid. You can check the displayed issuer name yourself, or open the document in Acrobat Reader, which applies its own trust list.
Is my document sent anywhere to be checked?
No, the whole verification — reading the signatures, computing the hashes, checking the signed range — runs in your browser, on your device. The file is never sent to a server.
What’s the difference between a PAdES signature and an old PKCS#7 signature, and what does an RFC 3161 timestamp prove?
PAdES (ETSI.CAdES.detached) is the current signature format, standardised for PDF; adbe.pkcs7.detached is the older format, still found on older documents but gradually being phased out. An RFC 3161 timestamp, when present, provides independent proof of the date on which the signature already existed, issued by a third-party timestamp authority rather than the clock of the signing computer.
What should I do if a signature shows "Chain not verifiable"? Which files can be checked?
"Chain not verifiable" only means that VellumPDF consults no list of trusted authorities, so it cannot confirm the authority that issued the certificate; that does not make the signature false. Compare the name shown under "Issued by" with the one you expected, or open the file in Acrobat Reader for a second opinion. Any PDF can be checked, including a password-protected one: VellumPDF reads the signatures without unlocking it, though some details may then not appear.