How We Check PDF Digital Signatures
The Signature Checker reads the signature dictionaries inside a PDF and reports who the certificate names, when the signing software says it signed, and whether each signature's signed byte range reaches the end of the file. It does not verify signatures cryptographically or check certificate trust. This page explains each step and how to read the result.
What the checker reports
- Each signature's signer name, reason, location, contact information and stated signing time
- Certificate subject and issuer names, validity dates and the signature algorithm
- Whether bytes were added after each signed range
- Certification level, document timestamps, signature field names and permission flags
What a result does not establish
- That a signature is mathematically valid or the signed content is unchanged
- That the certificate is trusted, was not revoked or was valid at signing time
- That a signature is legally binding or meets eIDAS or similar rules
Step 1: Finding signatures
The checker reads the raw bytes of the file and looks for signature dictionaries, marked by /Type /Sig or by one of the common signature sub-filters. For each one it reads the enclosing PDF object. It recognises these formats:
- adbe.pkcs7.detached, the most common PKCS#7 detached signature
- adbe.pkcs7.sha1, an older format that signs a SHA-1 digest
- ETSI.CAdES.detached, used for PAdES advanced electronic signatures in the EU
- ETSI.RFC3161, a document-level timestamp rather than a personal signature
Step 2: Reading the signature dictionary
From each dictionary the checker reads /Name, /Reason, /Location and /ContactInfo, the signing time in /M, and the filter and sub-filter names. These values are written by the signing software. The name in /Name can differ from the name in the certificate, and the time in /M comes from the signer's computer clock unless a trusted timestamp is also present.
Step 3: Checking byte-range coverage
A PDF signature covers the bytes listed in its /ByteRange, which leaves out only the space reserved for the signature value. If the signed range ends at the end of the file, the report says the signed range reaches the file end. If more bytes follow, it reports how many and sets the overall status to a warning.
Bytes after a signed range are often normal. When a second person signs, or a form field is filled after signing, the PDF is saved as an incremental update and the earlier signature no longer reaches the end. Only a validator that compares the revisions can tell whether those later changes were permitted.
Step 4: Reading the certificate
The signature value is a PKCS#7 container. The checker decodes it with OpenSSL, picks the signer's certificate from the certificates it contains, and shows its common name, organisation, country and email address, the issuer's name, and the validity dates. The signature algorithm, such as SHA-256 with RSA, is identified from the identifiers in the container, and a signature timestamp token is noted when one is embedded.
Validity dates are compared with today's date, so an older signature made with a certificate that has since expired is shown as expired. That alone does not mean the signature was invalid when it was made.
Step 5: Document-level settings
The checker also reports a DocMDP certification level when present: no changes allowed, only form filling and signing, or annotations, form filling and signing. It notes RFC 3161 document timestamps, lists signature field names, including empty fields waiting for a signature, and, for encrypted files, reads the printing, modification, copying and annotation permission flags.
What is not checked, and where to check it
PDFCheck does not recompute the document hash and compare it with the signed value, build the certificate chain to a trusted root, query revocation services (OCSP or CRL), consult the Adobe or EU trust lists, or validate long-term validation data. Signature fields stored inside compressed object streams can be missing from the field list. For a trust decision, open the file in a validator that performs these checks, such as Adobe Acrobat Reader, or a qualified validation service for EU signatures.
Worked examples
How common situations appear in the report:
| Situation | What the report shows | What it means |
|---|---|---|
| One signature, nothing saved after signing | Signed; the signed range reaches the file end | No bytes were added. Trust and cryptographic validity are still unchecked. |
| Two people signed one after the other | Warning on the first signature; the second reaches the file end | Usual for countersigned documents. |
| A form was filled in after signing | Warning with the number of bytes after the signed range | Check in a validator whether the change was permitted. |
| A document certified with "form filling and signing only" | Certified, with that permission level | The author allowed only those later changes. |
| An empty signature field, never signed | Unsigned, with the field name listed | The form expects a signature that has not been applied. |
| A certificate that expired after the document was signed | Expired next to the certificate dates | Normal for older documents; a trusted timestamp shows the signing time. |
Limits and file handling
The Free plan accepts files up to 50 MB; Pro and AI plans accept files up to 100 MB. The upload is written to private storage only while it is analysed and is deleted straight afterwards, including when analysis fails. The signature result is returned to your browser and is not saved as a report.
Check the signatures in a PDF
Upload a signed PDF to see its signatures, certificate details and byte-range coverage.
Check signatures