Question 1

What does "valid" actually mean here — is this a legal check?

Accepted Answer

A green verdict means exactly three things: the signature verifies cryptographically (the signer's certificate's public key confirms the signature over the signed attributes), the signed byte ranges are intact (the digest recomputed from the file matches the digest captured at signing time), and the coverage is complete (nothing was appended after the signed ranges). It is a technical integrity statement, not a legal one — this tool performs no identity verification, no revocation check, and no trust decision.

Question 2

Is the certificate checked against a trust store? What about revocation or timestamps?

Accepted Answer

Honestly, no. There is no trust store on your device that this tool consults, so no chain-of-trust validation happens: a self-signed certificate shows as self-signed — cryptographically valid but not chained to any authority you could name. No CRL or OCSP revocation check is made (the signer certificate could have been revoked after signing and this tool cannot know), and the timestamp inside a signature is read and displayed but never verified against a TSA. If you need those judgments, take the report to a qualified verifier.

Question 3

How is tampering detected — and what is "modified after signing"?

Accepted Answer

A PDF signature covers the whole file except the /Contents gap holding the signature itself — defined by /ByteRange. This tool recomputes the digest over exactly those bytes and compares it with the messageDigest captured inside the signed attributes at signing time: any byte changed inside the covered ranges → digest mismatch → TAMPERED. Separately, the coverage is compared with the actual file length: bytes appended after the covered ranges end — a later incremental update, an appended object, or trailing junk — are reported as "modified after signing" (the signed content itself is still intact in that case, which is why it is amber, not red).

Question 4

Is my signed document safe? Where does this happen?

Accepted Answer

Entirely inside your browser — a Web Worker reads the raw bytes, walks the structure, parses the certificates and runs the cryptography on this device. Nothing is uploaded, no account, no queue; the downloadable verification report is generated in the same worker, on-device too.

Verify PDF signatures

How it works

Frequently asked