Validate PDF signatures on your computer

Check signed bytes, PAdES level, RFC 3161 timestamps, embedded certificates, later revisions and OCSP/CRL revocation. The PDF and certificates stay in your browser.

Privacy: the PDF and certificates stay in your browser; only the certificate-published OCSP/CRL status is queried.

Add the signed PDF
Review signature integrity, certificate details and document coverage
Export a validation report for your records

What Validate PDF signatures does

Validate PDF signatures reads the digital signatures embedded in a PDF and tells you, signature by signature, whether the signed bytes are intact, which certificate signed them, whether the file was changed after signing, whether a trusted timestamp is attached, and whether the certificate has been revoked. It is a read-only check: the document is not modified, and the cryptographic verification is done by your browser rather than by a server.

The tool is aimed at the people who receive signed documents and need to know if they can rely on them: a contract signed by a supplier, a certificate issued by an administration, an invoice signed with a company certificate, or a document you signed yourself and want to check before sending. It reports on cryptographic signatures only; a scanned handwritten signature or a typed name is not something it can validate, and it says so.

How to validate a signed PDF

Add the signed PDF. There are no settings: the analysis starts on its own and a progress bar shows the document being read and the signatures checked.
Read the verdict banner. Signature integrity is valid means the signed bytes match; a warning banner asks you to review a specific problem; a neutral one tells you the revocation status could not be determined.
Open each signature card. It shows the signer and organisation, the digest algorithm, the signing time, the certificate validity period, whether the signature covers the whole current file or only an earlier revision, the PAdES level, the timestamp status and the revocation result.
Check the warnings. The most important one flags content appended after the signed revision, which is how later edits to a signed PDF show up.
Press Export validation report (JSON) if you need a record. The file is named after the PDF with the suffix _signatures and includes the SHA-256 of the document.

What is checked and what is not

Each signature is located through its byte range, the signed data is parsed as a CMS structure and verified against the embedded certificate. Timestamps are verified as RFC 3161 tokens, and they are marked as trusted only when the timestamp authority chain matches a recognised provider. PAdES baseline signatures are classified as B-B, or B-T when a valid timestamp is present. Revocation is checked through the OCSP or CRL services published in the certificate itself.

Several signatures in one document are supported; each one is reported separately with its own coverage and status.
Trust is established from the certificate embedded in the file. The browser cannot consult the operating system's certificate store or a national trusted list, so a valid signature is reported as embedded certificate or self-signed, not as legally qualified.
PAdES levels B-LT and B-LTA are not evaluated, and the tool does not analyse document permissions or XFA forms.
A revocation check that cannot be completed is reported as indeterminate rather than as valid.
Password-protected PDFs are refused. A signed document that is also encrypted cannot be validated here.
The report is JSON, not PDF. It records what was checked, what was not, and the result of every signature.

Privacy: the document and the certificates stay in your browser

Locating the signatures, hashing the signed bytes, verifying the certificates and checking the timestamps is all done inside the browser tab. The PDF is never uploaded and the certificates are never sent anywhere.

Revocation is the one step that needs the network, because the certificate's status is published by its issuing authority. For that query the browser sends, through OléPDF's own domain, only the address of the OCSP or CRL service printed in the certificate and, for OCSP, the certificate identifier. The exported report states this explicitly: documentUploaded false, certificateUploaded false.

Typical uses

Confirming that a contract received by email still carries an intact signature and has not been altered after it was signed.
Checking that a certificate or a permit issued by an administration is signed with a timestamp and a certificate that was not revoked.
Verifying your own PAdES signature before sending a document to a client or a public portal, and keeping the JSON report alongside it.

Frequently asked questions

Is validating PDF signatures free?

Yes. The check is free and unlimited, with no account and no daily cap. Exporting the JSON report is included.

What does Integrity valid mean exactly?

That the bytes covered by the signature have not changed since they were signed and that the signature verifies against the certificate embedded in the file. It does not by itself say who the signer is in legal terms.

Why does it say content was appended after the signature?

Because the file is longer than the revision the signature covers. That happens when a PDF is edited, re-saved or signed again after the first signature. Review the later changes before trusting the document.

Does it recognise handwritten or drawn signatures?

No. An image of a signature or a typed name is not a cryptographic signature. The tool reports No digital signatures found for such documents.

Is this a legal certification of the signature?

No. It verifies integrity, timestamps and revocation cryptographically, but it cannot consult the trust lists that make a signature legally qualified. Use it as a technical check, not as a certification service.

What is sent over the network?

Only the revocation query: the OCSP or CRL address published in the certificate and the certificate identifier. Neither the PDF nor the certificates leave your browser.

Protect and Review

All tools

Photos rather than PDFs? Try OléPIC, our image tools.