Validate PDF Signature

Upload the PDF and validation starts on its own. For each signature the tool hashes the bytes the signature covers, compares that hash with the digest stored inside the signature, and then verifies the signature against the signer's public key; any change to the covered bytes makes the status Invalid with the reason shown on the card. Every signature in the file gets its own card, and the summary at the top counts how many were found.

Valid means the signature was cryptographically verified, covers the whole file, and uses a secure digest. Invalid means verification ran and failed, for example because the bytes changed or the key doesn't match. Unverified means the signature uses an algorithm the tool can't check, such as Ed25519 or SM2, so confirm it in Adobe Acrobat or with openssl before relying on it.

RSA with PKCS#1 v1.5 padding, RSA-PSS, and ECDSA on the P-256, P-384, and P-521 curves, with SHA-224, SHA-256, SHA-384, or SHA-512 digests. Signatures hashed with MD5 or SHA-1 are flagged with an Insecure Digest status and never reported as valid, because both algorithms have published collision attacks.

The tool has no built-in list of certificate authorities, so on its own it can confirm the signature is intact but not who is behind the certificate. Upload your organization's root or intermediate certificate as a .pem, .crt, .cer, or .der file and validation reruns: signatures whose certificate matches it or chains back to it get a Trusted badge, and the summary counts those as valid.

It means bytes were appended after this signature was applied, and the tool reports it as Invalid with the note Modified After Signing (partial coverage). That is not proof of tampering by itself: a second signature or an incremental save produces the same result, and only the last signature added can cover the entire file. Treat it as a reason to look at what was added.

No. The tool checks the certificate's validity dates, the trust chain against a certificate you provide, and the cryptographic integrity of the signature, but it doesn't query OCSP responders or certificate revocation lists. For a revocation check, verify the file in a desktop tool with network access.

Expiry is judged against today's date, so a certificate that is now past its Valid Until date shows a Certificate Expired status and isn't counted as valid in the summary, even if the signature itself checks out. Compare the Signed On time with the Valid From and Valid Until dates on the card to see whether the certificate was current at signing.

No. Signature parsing and the cryptographic checks run in your browser using node-forge and the Web Crypto API, so the document and any certificate you add stay on your device.