PDF Signature Checker

How to use this PDF signature checker

1. Select a PDF file.
2. See whether it contains any signature fields.
3. Review the declared signer, date, and reason for each signature found.

What does this actually check?

It scans the PDF's internal structure for signature dictionary objects and reads their declared fields (name, date, reason, location) as embedded by whatever tool created the signature — this confirms a signature field exists and what it claims, not that it's cryptographically valid.

How real PDF digital signature verification actually works

A cryptographically valid PDF signature relies on public-key cryptography, not just a name typed into a field. When someone signs a PDF with real signing software, the software computes a cryptographic hash of the document's content at that moment and encrypts that hash with the signer's private key, embedding the result (a PKCS#7/CMS signature block) alongside a copy of the signer's public key certificate. Verifying the signature means recomputing that hash from the document as it currently exists, decrypting the embedded signature using the certificate's public key, and checking the two hashes match — and separately, checking that the certificate itself was issued by an authority the verifying software trusts, often chaining up through several intermediate certificates to a trusted root.

Why the declared metadata fields can be forged

The signer name, date, reason, and location fields that this tool reads are stored as plain, human-readable text inside the PDF's signature dictionary — they're metadata the signing software wrote down, not values that are cryptographically bound to the signature itself in a way that prevents tampering. This means someone could, in principle, add a signature field to a PDF and populate these fields with any name and date they choose, without any real cryptographic signing having occurred at all. This is exactly why this tool carries an explicit warning: reading these fields tells you what a document claims about its signature, but proves nothing about whether a genuine, verifiable signing operation actually took place.

What a genuine signature actually protects against

The real value of a cryptographic PDF signature is tamper-evidence: because the signature is mathematically tied to the exact byte content of the document at the moment of signing, any change to the document afterward — even a single character edited in the text — changes the hash and breaks the match between the recomputed hash and the signed one, causing verification to fail visibly. This is what lets a properly verified signature answer two separate questions with real confidence: who signed this (assuming their certificate is trusted), and has this exact document been altered since they signed it. Neither of those guarantees exist when only reading the declared metadata fields, which is the core distinction this tool can't bridge.

Trust levels — why some checkmarks mean more than others

Not all valid cryptographic signatures carry the same weight, because trust flows from the certificate used to sign, not just from the math being correct. A certificate issued by an Adobe Approved Trust List (AATL) authority or another recognized certificate authority, following identity verification of the signer, carries meaningfully more trust than a self-signed certificate anyone can generate for free in seconds with no identity check at all. Software like Adobe Acrobat distinguishes between these cases visually (a green checkmark for a fully trusted, valid signature versus a warning icon for a technically valid but untrusted or self-signed one), a distinction that has no equivalent in a tool that only reads plain-text metadata, since it isn't parsing certificates or evaluating trust chains at all.

Limitations of this tool

This tool detects the presence of signature dictionary objects in a PDF's internal structure and displays whatever plain-text metadata fields (signer name, date, reason, location) are declared inside them — it does not parse the PKCS#7/CMS cryptographic signature data, does not validate a certificate chain, does not check certificate revocation status, and does not detect whether the document was modified after signing. For any situation where you actually need to trust a signature — a legal document, a contract, a formally signed agreement — use dedicated software like Adobe Acrobat or a specialized PDF signing platform that performs real cryptographic verification, and treat this tool strictly as a quick way to see whether a signature field exists at all and what it claims.