Who signed this PDF, and was it changed afterwards?
The checker shows who signed a PDF, when, and which certificate was used. It also checks whether anything was added to the file after signing. In our test, one later edit left 191 unsigned bytes at the end, and the checker warned about it. It reads the signature but does not prove it is genuine or trusted.
How can I tell if a signed PDF was edited?
Look at the result for each signature. "Signed range reaches file end" means nothing was added after signing. "Bytes follow signed range" means later changes were saved on top, and the checker counts the extra bytes. A second signature, a filled-in form or an added comment also adds bytes, so check the last signature first.
Does this prove the signature is valid?
No. It reads the signer's name, the dates and the certificate details. It does not recheck the cryptography, decide whether the certificate is trusted or check revocation. Use Adobe Acrobat or your e-signature provider for that. In our test, a self-signed certificate was shown here without any warning.
Why does it say there is no signature when I can see one?
A scanned handwritten signature or a typed name is just part of the page, so it never shows up here. An empty signature box is not a signature either. Printing to PDF or re-saving through a converter also removes a real digital signature, so ask the sender for the signed original.
How we tell if a signed PDF was changed
A PDF signature cannot cover itself, because the signature value is stored inside the file it signs. The signing software therefore leaves a gap for the signature and records the signed parts in /ByteRange as four numbers: the start and length of the bytes before the gap, then the start and length of the bytes after it. Everything outside the gap is hashed and signed.
The checker adds the third and fourth numbers to find where the signed data ends and compares that with the file size. If they match, within two bytes, the result is "Signed range reaches file end". If the file is longer, it reports "Bytes follow signed range" and counts the extra bytes.
Measured: one signature, then one appended edit
Signed file, 19,613 bytes ByteRange [0 1840 13584 6029] signed: bytes 0 to 1,839 gap: bytes 1,840 to 13,583 (11,744 bytes holding the signature) signed: bytes 13,584 to 19,612 13,584 + 6,029 = 19,613 = file size -> Signed range reaches file end Same file after appending an update that changed the title to "Edited after signing", 19,804 bytes signed data still ends at 19,613 -> Bytes follow signed range, 191 unsigned bytes Summary: "This document contains 1 digital signature. The document is certified. Warning: the document may have been modified after signing." pdfsig on the same file: Signature is Valid, Not total document signed
How to interpret bytes after the signed range
PDF editors save changes by appending an incremental update instead of rewriting the file, so the original signed bytes stay intact and the signature remains mathematically valid, as pdfsig confirmed above. The later bytes can change what a viewer displays, which is why the extra bytes matter more than the signature status itself.
Not every appended update is suspicious. When a second person signs, their signature is itself an incremental update, so the first signature in a two-signature document will always show bytes after its range. Compare against the last signature: in a document whose final step was signing, the last signature should reach the end of the file. Form filling and adding comments after signing also append updates, and a certification level may permit exactly that.
Fields read from each signature
| Entry | Shown as | Note |
|---|---|---|
/Name |
Name | Typed by the signer's software; may differ from the certificate |
/Reason, /Location, /ContactInfo |
Reason, Location, Contact | Optional free text |
/M |
Recorded Signing Date | Taken from the signer's computer clock unless a timestamp token is present |
/Filter |
Signature Filter | The handler, for example Adobe.PPKLite |
/SubFilter |
Signature Format | adbe.pkcs7.detached, adbe.pkcs7.sha1, ETSI.CAdES.detached or ETSI.RFC3161 for a document timestamp |
/Contents |
Certificate Information | Common name, organisation, country, issuer, algorithm and validity dates read from the embedded certificate |
Certification levels
A certifying signature adds a DocMDP entry whose /P value states which later changes the author allows. The checker reports the declared value; it does not test whether later updates stayed within it.
| /P value | Shown as | Later changes the author allows |
|---|---|---|
| 1 | No Changes Allowed | None |
| 2 | Form Filling & Signing | Filling in form fields and adding signatures |
| 3 | Annotations & Forms | As 2, plus comments and other annotations |
| Missing or unreadable | Declared Certification | A DocMDP entry exists but its value was not read |
What the checker does not verify
- It does not recompute the hash or check the cryptographic signature value. Use a full validator, such as Adobe Acrobat or pdfsig, for that.
- It does not decide whether the certificate is trusted. In our sample the issuer and subject were both "Test Signer", the mark of a self-signed certificate, and the checker displayed it without comment.
- It does not check revocation lists or OCSP responses.
- Expiry is judged against today. A certificate that expired after the document was signed may still have been valid at signing time, especially when an RFC 3161 timestamp proves when the signature was made.
- Permissions are read from the encryption dictionary. An unencrypted file is shown with printing, modification, copying and annotations all allowed.
When no signature is found
The result "This document does not contain any digital signatures." means no signature dictionary was found in the file bytes. A scanned handwritten signature or a typed name is just page content and will never appear here. An empty signature field waiting to be signed is also not a signature. If you expected a digital signature, ask the sender for the signed original: printing to PDF or re-saving through a converter rebuilds the file and discards the signature.
Last updated . Field and status rules are taken from the checker's source code. The sample was produced on 12 October 2026: a test PDF signed locally with TCPDF and a self-signed OpenSSL certificate, then given an appended update; both files were run through the checker's service and through Poppler pdfsig 26.10.0 for comparison.