How to Verify a Digital Signature in a PDF

Someone sends you a “signed” PDF. It looks official. There may be a stamp, a name, or a blue ribbon on the page. That alone does not prove the file is real or unchanged.

A digital signature on a PDF is different from a picture of handwriting. It is a math seal. If you know how to check it, you can see:

• whether the signed part of the file still matches what was signed
• which certificate (digital ID) was used
• whether anything was added after signing
• whether you have a reason to trust that certificate

This guide explains what that seal is, why checking it matters, how to read the result, and how to verify a signed PDF step by step.

To verify a signed PDF now, open Verify PDF Digital Signature, drop the file, and read the report. Below is what those checks mean.

Short answer

Digital signature vs signature image

People use the word “signature” for two different things.

1) Signature image (drawn, typed, or scanned)

You draw a name, type it in a fancy font, or paste a photo of ink on paper. The PDF shows that mark.

There is no math seal. Anyone could copy the image. A verifier cannot prove the file is unchanged from that picture alone.

Tools that only place a drawn or typed mark (including many “Sign PDF” pages) create this kind of visible mark. Useful for casual approval. Not the same as a digital signature you can verify.

2) Digital signature (certificate-based)

The signing software:

1. Takes a fingerprint (hash) of the protected bytes in the PDF
2. Seals that fingerprint with the signer’s private key
3. Stores the seal plus the signer’s certificate inside the PDF

Later, verification uses the public key in that certificate to check the seal, and re-hashes the same bytes to see if they still match.

That is why one changed character, one replaced page, or a careless edit can break the signature.

In PDF work, these seals often follow formats such as PKCS#7 / CMS, and in Europe PAdES (PDF Advanced Electronic Signatures). You do not need the acronyms day to day — you only need to know that a real digital signature lives inside the file as data, not only as ink on the page.

Why verification is important

Checking a digital signature answers practical questions:

1) Did the document change after signing?
If the protected bytes no longer match, the seal fails. That protects against silent edits to amounts, dates, names, or attached pages.

2) Which digital ID sealed it?
The certificate shows a subject name, issuer (who issued the ID), and validity dates. You can see which key was used — not only a logo on the page.

3) Is the signing time trustworthy?
The clock on the signer’s computer can be wrong. A trusted timestamp (RFC 3161) from a time-stamping service is stronger evidence of when the seal was made.

4) Should you rely on this file for a decision?
Contracts, invoices, tax papers, court filings, and HR forms often need more than “it looks signed.” Verification is the first technical check before you act on the file.

Skipping verification is like accepting a sealed envelope without checking if the seal is broken.

What “verify” actually checks

A good check separates three ideas. Mixing them up causes confusion.

A) Document integrity

Recompute the hash of the signed byte range. Compare it with what was sealed.

• Match → signed content looks unchanged
• No match → something in the covered range changed, or the signature data is damaged

B) Signature authenticity (crypto check)

Check that the seal was made with the private key that matches the certificate inside the PDF.

• Pass → the certificate shown and the seal fit together
• Fail → wrong key, broken signature, or unsupported algorithm

Important: this proves the seal matches that certificate. It does not by itself prove the person is who they claim in real life. Anyone can make a self-signed certificate with any name.

C) Trust

Trust means: do you (or your company) accept the certificate authority that issued that ID?

A verifier can prove the seal and rebuild the certificate chain. Trust is still your decision: is this issuer one you accept for this document?

Good tools show the full chain and fingerprints so you can decide — and let you mark roots you trust. That is normal signature practice, not a weak check.

What the status messages usually mean

Wording differs by app, but the ideas are the same.

Never trust a green tick blindly. Open Signature Properties (or the detailed report) and read:

• signer name and issuer
• signing time and whether a timestamp exists
• whether the signature covers the whole current file or only an older revision

Chrome, phone viewers, and Preview often are not enough

Built-in PDF viewers in many browsers (including Chrome’s) and Apple Preview are built for reading pages. They often cannot fully show or validate digital signatures the way Acrobat Reader or Foxit can.

If you only open the file in a browser tab and see no signature panel, that does not mean the file is unsigned. Download it and check in a proper reader — or use a dedicated verifier.

How to verify in Adobe Acrobat Reader (free)

Adobe’s own help describes this flow. Steps can move slightly as the app UI changes, but the idea stays the same.

1. Install or open Adobe Acrobat Reader (the free Reader is enough for validation).
2. Open the signed PDF.
3. Open the Signatures panel (often from the right side; if hidden, use View → Show/Hide → Side panels → Signatures).
4. Let Reader validate, or use the panel Options → Validate Signatures.
5. Click the signature → Signature Properties.
6. Review the validity summary.
7. Choose Show Signer’s Certificate to see issuer, dates, and the chain.

Also check the message bar at the top of the document. Icons and short text often summarize the result when the file opens.

If Reader says the signature has problems

Common causes:

• Self-signed certificate (not in Adobe’s trusted list)
• Certificate expired relative to the validation rules
• Document changed after signing
• Timestamp present but not trusted / not verified
• Corporate PDF that needs your company’s root certificates installed

Do not click “trust this certificate forever” unless you independently know the signer and the issuer. Trust is a security decision, not a button to silence a warning.

How to verify in Foxit Reader

Foxit can validate on open (depending on preferences).

1. Open the PDF in Foxit Reader.
2. Use the signature / Protect tools to Validate, or click the signature with the Hand tool.
3. Open Signature Properties → certificate details.
4. Read whether the status is valid, invalid, or unknown because the signer is not trusted.

Same rule: unknown often means “not trusted yet,” not always “forged.”

How to verify with MyPDF Guru

Use Verify PDF Digital Signature when you want a full signature report without installing desktop software.

Steps

1. Open Verify PDF Digital Signature.
2. Drop the signed PDF (or choose it from your device).
3. Wait for the checks to finish.
4. Read the overall verdict and each signature’s results.
5. Open technical details for certificate chain, fingerprints, and timestamp data.
6. Download a PDF or JSON report if you need a copy for your records.

What the tool checks

The verifier runs a full cryptographic check on the PDF — the same core work a serious signature tool does:

• Finds real digital signatures (PKCS#7 / CAdES / PAdES and related formats)
• Checks the signed byte range and recomputes the document hash for integrity
• Verifies the signature value against the signer certificate (authenticity)
• Checks certificate binding and validity at signing time
• Rebuilds and verifies the full certificate chain, link by link
• Shows certification vs approval signatures, and what changed in later revisions
• Validates RFC 3161 timestamps when present
• Reports long-term validation data when it is embedded in the file
• Lets you add trusted root certificates and re-check trust against them
• Flags weak legacy digests such as SHA-1
• Gives a clear verdict plus a PDF / JSON report you can save

All of this runs in your browser on your device. The file is not sent to a MyPDF Guru server for verification.

If the PDF only has a drawn or scanned signature image, the tool reports that no digital signature was found — because an image is not a cryptographic seal.

How to read a verification report (any tool)

Ask these questions in order:

1. Is there a real digital signature?
   If not, you only have a visual mark or an unsigned file.

2. Does integrity pass?
   If not, do not treat the current file as the signed original.

3. Who is on the certificate, and who issued it?
   Match the name to the person or company you expected. Check the issuer.

4. Is there a trusted timestamp?
   Prefer the timestamp time over a clock time from the signer’s PC when both exist.

5. Does the signature cover the whole file you are looking at?
   Extra signatures or timestamps can append revisions. Extra page content after signing is a bigger concern.

6. Do you trust the issuer?
   Only then treat “valid” as business-ready.

Common mistakes

Soft rules after you verify

• Keep the verified file as received. Do not “clean it up” and re-send as if it were the same sealed original.
• If integrity fails, ask the sender for a fresh signed copy.
• If trust is unclear, ask which certificate authority was used, or confirm out-of-band (known email, company portal, phone).
• For high-stakes legal or government files, follow your local rules and the software your organisation requires — this guide is technical help, not legal advice.

Quick checklist

• [ ] File opened in a tool that can actually validate digital signatures
• [ ] At least one real digital signature found (not only a drawn image)
• [ ] Integrity / “document not altered” check understood
• [ ] Signer certificate and issuer reviewed
• [ ] Timestamp checked if present
• [ ] Trust decision made on purpose (not by clicking through a warning)

Bottom line

A PDF digital signature is a seal on the file’s bytes, tied to a certificate. Verifying it tells you whether the sealed part still matches, which digital ID sealed it, and whether later changes sit outside that seal.

A signature image cannot do that job.

Verify with MyPDF Guru, Adobe Acrobat Reader, or Foxit. Read integrity and the certificate first; then decide trust in the issuer on purpose.

Helpful references

• Adobe: Validate digital signatures
• Adobe: Verify certificate information
• EU digital building blocks: eSignature FAQ (electronic signature vs digital signature concepts)