PDFSIG: Check What a Signed PDF Says About Itself
The question is never whether a certificate is pretty. It is whether anybody changed the document after it was signed, and that has an arithmetic answer. This takes the byte ranges the signature says it covers, hashes exactly those bytes, pulls the digest out of the PKCS#7 blob, and tells you whether the two are the same number. Then it shows you every byte of the file that the signature leaves out, and what lives there.
1. The signed PDF
Any PDF. If it has no signature in it, that is what it will say, and it will say how it looked.
2. What the signature says, and what the bytes say
The first is a claim. The second is arithmetic. They are kept apart below.
What this is, and what it is not
The check that matters is a comparison of two numbers. A PDF signature names the byte ranges it covers in a /ByteRange array, and carries a PKCS#7 blob whose signed attributes include a messageDigest. This hashes exactly the bytes those ranges name, with the algorithm the signature itself declares, reads the messageDigest out of the DER with an ASN.1 reader written for the job, and compares them. If they are the same, nothing inside the covered range has changed since it was signed. If they are not, either the bytes changed or the signature was never over this file.
What is not covered is the interesting part. A signature can never cover its own /Contents, so there is always one gap, and that gap is expected. Anything else outside the range is bytes added afterwards, which is how a PDF is edited: by appending a new revision rather than by rewriting. Those bytes are listed here by offset, and the objects defined inside them are listed with what they are, so you can see what the later revision changed. A signature over an earlier revision stays arithmetically sound while the document you are shown is different.
What this does not do, in those words. It does not validate a certificate chain. It does not check revocation. It does not tell you the signer is who the certificate says. It tells you whether the bytes are intact under the signature and what the signature claims. A certificate in a file is a claim made by whoever made the file; deciding whether to believe it needs a trust store, a revocation check and a policy, and none of those are here.
It does verify one thing with the key that is in the file. Where the signature is RSA with a hash this browser offers, the signature over the signed attributes is checked against the public key in the certificate that came with it. That is still arithmetic, not trust: it says the holder of that key signed those attributes. It says nothing about who holds the key. RSASSA-PSS is reported as unchecked rather than guessed at, because its parameters have to be read to check it properly.
The PDF is lexed here rather than handed to a library. The cross-reference chain is walked back through /Prev to find every revision, and the object index is built by scanning the file for object definitions rather than by trusting the cross-reference tables, because a file whose tables are wrong is exactly the file worth examining. Signature fields are found twice over: through the AcroForm field tree, and by walking every page's annotations, so a signature widget that is on a page but missing from the form tree is still reported.
Nothing is uploaded, and the page picture is optional. The file is read into this tab and the report is built there. A picture of the signed page can be drawn, using the PDF renderer this site serves from its own origin, only when you ask for it. If that renderer cannot be loaded the report is unchanged, because nothing in the report comes from it.
Questions people ask
It says the digest matches. Is the document genuine?
It says the covered bytes have not changed since they were signed. That is a real and useful fact and it is not the same as genuine. Genuine also needs the certificate to belong to who you think, to have been valid at the time, and not to have been revoked, and none of those are checked here. The report says so where it prints the certificate.
It says bytes were added after signing. Has the document been tampered with?
Not necessarily. Appending is how a PDF is edited, and a second signature, a filled-in form field or an added comment all appear as bytes after the first signature. What matters is what those bytes contain, which is why they are listed with the objects defined inside them. A new page content stream in that region is a different thing from a second signature field.
Why does the signature not cover the whole file?
It cannot. The signature is written into the file as the /Contents string, and it cannot contain a hash of itself, so the hole it sits in is always outside the range. A signature that covers everything except that hole is covering the whole document.
What does DocMDP mean?
It is the permission the signer attached: no changes allowed, form filling allowed, or form filling and annotation allowed. It is printed in those words rather than as a number. It is a declaration inside the file: a reader is expected to honour it, and a tool that does not honour it can still change the document.
Can it check a document timestamp?
It reads one. If the signature carries a timestamp token, the time inside it is shown along with the authority that issued it, kept separate from the signing time the signer wrote, because one is a third party's assertion and the other is the signer's own. Whether that authority is trustworthy is not checked, and the page says so.
Is my PDF uploaded?
No. It is read in this tab, hashed in this tab with the browser's own crypto, and the report is drawn in this tab. Open the network tab in your browser's developer tools while you use it; the only request is for the page and, if you ask for a picture of the page, the PDF renderer from this site.