What does 'valid' mean here?

The CMS signature verifies cryptographically against the byte range it covers, and that range spans the entire file — so the document is unmodified since signing and the signature is intact.

Why would a signature show as invalid?

The document was modified after signing, the signature blob is corrupted, or the certificate expired. The detail view shows which check failed.

What does 'modified after signing' mean?

Bytes exist in the file beyond what the signature's byte range covers — typically an incremental update appended later. The original signed content may still verify, but something changed afterwards.

Can I verify multiple PDFs at once?

Yes — drop several signed PDFs and each gets its own report card. Export produces one JSON document covering all of them.

Does it check whether the certificate is trusted?

It reports the chain embedded in the signature and whether it verifies to its own root. It does not consult external trust stores or revocation lists — a self-signed certificate is reported as self-signed, and you decide whether to trust it.

Does it detect document timestamps?

Yes. RFC 3161 timestamps (ETSI.RFC3161 subfilter) are listed as document timestamps with the certified time, alongside regular signer signatures.

Is anything uploaded?

No. All parsing and cryptographic verification happens in your browser. The file never leaves your device.

Xác thực chữ ký số PDF: kiểm tra người ký và toàn vẹn

Kiểm tra chữ ký số trong PDF: danh tính người ký, chuỗi chứng chỉ, thời điểm ký và phát hiện bị sửa đổi. Miễn phí, chạy hoàn toàn trên trình duyệt.

1. Select signed PDFs

Drop one or more signed PDF files. Verification runs locally in your browser.

2. Review results

Every signature is listed with validity, signer identity, chain, and signing time.

3. Export report

Download a JSON validation report for audit trails.

Check whether a signed PDF is still trustworthy

What verification actually checks

A PDF signature is a CMS (PKCS#7) blob embedded in the file, covering a declared byte range. This tool parses every signature dictionary, extracts the CMS structure, and runs three checks: does the signature cryptographically verify against the bytes it claims to cover, does the byte range span the whole file (so nothing was appended after signing), and what does the embedded certificate chain look like.

The result is a per-signature report: signer name and full subject, issuing CA, serial number, validity window, SHA-256 fingerprint, signing time, and a clear verdict — valid, modified after signing, or invalid.

What the report shows

Everything a verifier needs to make a trust call.

Validity verdict

Valid, modified-after-signing, or invalid — with the cryptographic check behind each call.

Certificate details

Subject, issuer, serial, validity dates, and SHA-256 fingerprint for every embedded certificate.

Signing time

The claimed signing time from the CMS attributes, plus RFC 3161 timestamp tokens when present.

Batch + JSON export

Verify several PDFs at once and export the whole result set as a JSON report for compliance records.

Tamper detection

The most important check is coverage: a signature only protects the bytes inside its byte range. If a document was modified after signing — a page added, a field changed, an incremental update appended — the signature either fails verification or provably does not cover the tail of the file. Both cases are flagged, so 'signed' never silently means 'unchanged'.

Document timestamps (ETSI.RFC3161 signatures) are recognized and reported separately, including the time the timestamping authority certified.

Local and private

Verification is pure parsing and math — no network, no upload, no OCSP or CRL fetches. The chain check reports what the embedded certificates prove on their own; whether you trust the issuing CA is a decision the report informs rather than makes.