Check a signed email or .p7m file
Drop a signed .eml, a .p7m, or a smime.p7s with the file it signs. See whether it has changed, whose certificate signed it, and what it contains. Nothing is uploaded.
The signed email or file
Drop a signed .eml, a .p7m, or a .p7s with the file it signs
The file it signs
A .p7s on its own is only the signature. Choose the file it was made for, and the two are checked together.
What the signature says
What was signed
Who it is encrypted to
What smime.p7s and .p7m files are
An email signed with S/MIME carries an attachment called smime.p7s. It is not a document: it is the signature, and the certificate of the person who made it. A mail program that understands it shows a rosette or a tick; one that does not shows a mysterious attachment. A .p7m is the same kind of signature with the signed thing wrapped inside it: an email sent as smime.p7m, or a document signed as a file, like contract.pdf.p7m, which is the usual way signed documents are sent in Italy.
What is checked
- That nothing has changed. The signed part is hashed and compared with the digest the signer recorded, byte for byte, including every attachment inside it.
- That the signature is real. It is checked against the key in the signer's certificate with your browser's own cryptography: RSA, RSA-PSS and ECDSA, with SHA-1 to SHA-512.
- Whose certificate it is. The address in the certificate is compared with the address the email says it is from, because S/MIME signs the body and not the From line.
- Where the certificate comes from. Each certificate included is checked against the one that claims to have issued it, up to the root, and each is read the way CERTLENS reads certificates: dates, purpose, key.
- What was inside. The text and attachments the signature covers are listed, and the file inside a .p7m can be saved on its own, exactly as it was signed.
What it does not do
It does not decide whether the root at the top is trusted. That depends on the roots installed on the computer reading the mail, so it names the root and gives its fingerprint instead. It does not check revocation, which would mean asking the certificate authority over the network, and it does not check timestamps from a timestamping service, which it names when it sees one. Encrypted email cannot be opened without the recipient's private key, which this page never asks for; it says who the message was encrypted to. PGP signatures are a different format and are not read here, and neither are Ed25519 signatures or compressed CMS.
Questions people ask about SIGNET
What is the smime.p7s attachment?
It is the digital signature on an email signed with S/MIME, together with the sender's certificate. It is not a document and there is nothing in it to read. Drop the whole email, saved as an .eml, on this page to check the signature and see whose certificate made it.
How do I open a .p7m file?
Drop it here. SIGNET checks the signature and takes the signed file out of its wrapper, so contract.pdf.p7m gives back contract.pdf exactly as it was signed. A .p7m that is encrypted rather than signed cannot be opened without the recipient's private key.
How do I verify an S/MIME signature without Outlook?
Save the email as an .eml, which every mail program can do, and drop it here. The signed part is hashed and compared with what the signer recorded, and the signature is checked against their certificate, in your browser.
Does a valid signature mean the email is genuine?
It means the signed part has not changed and was signed with the key in that certificate. It does not cover the From line, which is why SIGNET compares the address in the certificate with the address the email claims to be from, and it does not mean the certificate authority is one your computer trusts.
Why does my mail program say the signature is invalid?
The usual reasons are that the message was changed after signing, often by a server adding a footer; that the certificate had expired when it was used; that it was signed with SHA-1, which Thunderbird rejects; or that the root certificate is not installed on your computer. SIGNET says which.
Is my email uploaded?
No. The email, the signature and the certificates are read in this tab, and the signature is checked with your browser's built-in cryptography. Nothing is sent anywhere.
Worth reading first
Related tools
- CERTLENSTake a certificate or a chain apart and check it
- HEADERPROOFCheck if an email is really from who it says
- MAILBOXTake an email apart and see where it came from
- SATCHELOpen an Outlook .msg or a winmail.dat without Outlook
- POSTBAGOpen an .mbox file or a Gmail Takeout zip and read every email in it
- ASSERTRead a SAML response and check it without sending it anywhere