QiLing Tools🎖️Verify PDF Digital Signatures - Check Validity & Tampering
When you receive a signed contract, certificate or invoice as a PDF, how do you know the signature is genuine and nothing changed after signing? This tool verifies each digital signature in a PDF right in your browser. It finds every signature field (with its name, page and visibility) and signature dictionary, then checks the ByteRange: that it starts at the beginning of the file, that the gap holds only the signature data, and whether it reaches the end of the file — if revisions were appended after signing, it tells you how many and whether they contain a later signature, DSS validation data, a document timestamp, or annotations and other edits. Next it parses the PKCS#7 / CMS SignedData, recomputes the SHA-1/256/384/512 digest over the ByteRange and compares it byte for byte with the signed messageDigest attribute, verifies the signature value with the browser’s built-in WebCrypto (RSA PKCS#1 v1.5, RSA-PSS, ECDSA P-256/384/521, Ed25519) and checks the signingCertificate attribute. For certificates it lists the signer’s certificate and the chain embedded in the file, verifies each issuer’s signature on the certificate below it, and shows subject, issuer, validity, key usage and SHA-256 fingerprint, including whether the certificate was valid at signing time. It supports RFC 3161 signature timestamps and document timestamps (ETSI.RFC3161), checking the timestamped data and the timestamp authority’s signature, and shows the DocMDP certification level, DSS / LTV data and revocation data embedded in the signature. Note that there is no built-in trusted root store and no online revocation check, so the tool proves the content is unchanged and the signature is mathematically sound; whether the signer’s identity is trustworthy is for you to judge from the chain and fingerprints. Files are never uploaded.
Free · No sign-up · Runs in your browserLast updated:
How to use PDF Signature Verifier
- 1Upload a signed PDF; every signature and timestamp is found automatically
- 2Read each verdict: digest comparison, signature value check, ByteRange coverage and changes after signing
- 3Expand the certificate chain to check the signer, issuer, validity and fingerprints, and export a JSON report if needed
FAQ
- Does “Signature valid” mean the signer can be trusted?
- Not entirely. “Valid” means the signed content hasn’t changed since signing, the signature really was produced with the certificate’s public key, and the issuing relationships inside the chain hold. But there’s no built-in trusted root store and no online revocation check, so the tool can’t tell you whether a recognised authority vouches for the signer. Check the issuer and fingerprints in the chain, or re-verify in software with a configured trust list such as Adobe Acrobat.
- What does “revisions appended after signing” mean?
- PDFs support incremental saves: changes after signing are appended to the end of the file and the signed bytes stay untouched, so the old signature still verifies, but the appended content isn’t protected by it. If the additions are only a second person’s signature, DSS long-term validation data or a document timestamp, that’s a normal multi-signer or archiving workflow; if they include annotations or other edits, check what changed after signing.
- Why can some signatures not be fully verified?
- Usually because the algorithm isn’t supported by the browser’s WebCrypto (MD5, SHA-224, SM2/SM3, DSA), the signer’s certificate isn’t included in the signature, or the format is unusual. The tool still shows the ByteRange, certificate and timestamp details it can parse, but won’t call the signature valid.
- Is my file uploaded to a server?
- No. Parsing, digest calculation and signature verification all happen in your browser, so contracts and other sensitive files never leave your computer, and the tool doesn’t contact OCSP, CRL or timestamp servers.