Verify any signed PDF
in seconds

Check who signed a PDF, when it was signed, and whether the signed content was changed. Free, no account needed.

Drop your PDF here
or click to browse
Up to 50 MB · Processed in memory · Not stored
Privacy-first
No account needed
50 free verifications / day

How It Works

1

Upload PDF

Drag and drop or select a digitally signed PDF. Signatures stored as CMS/PKCS#7 (as in PAdES) are read.

2

Automatic Checks

Each signature is checked: signed bytes unchanged, signature valid for the signer's certificate, embedded certificate chain consistent, certificates within their dates.

3

Detailed Report

See who signed, when, whether the signed content changed, the certificate details and any RFC 3161 timestamp.

Verifying signatures...
Error

Need tamper-evident e-signing for your contracts?

Start Signing Free → econtract.online

🔌 Verify API

Check PDF signatures from your app with one call: POST https://api.econtract.online/verify-pdf, multipart field file, up to 50 MB. Free, no API key, 50 requests a day per IP. Reference: developer docs · OpenAPI.

    

    
Response

    
{
  "document": {
    "filename": "contract.pdf",
    "hash": "sha256:a11f904a...",
    "size": 245780,
    "tampered": false
  },
  "signatures": [
    {
      "signer": { "name": "John Doe", "email": "[email protected]", "organization": "Acme Corp", "country": "US" },
      "signed_at": "2026-03-21T10:54:51Z",
      "reason": "Approved",
      "verdict": "valid",
      "integrity": true, "signature": true, "chain": true, "expired": false,
      "certificate": {
        "subject": "CN=John Doe, O=Acme Corp, C=US",
        "issuer": "CN=Example CA",
        "valid_from": "2026-03-01T00:00:00.000Z",
        "valid_until": "2029-03-01T00:00:00.000Z"
      },
      "timestamp": { "time": "2026-03-21T10:54:52.000Z", "tsa": "CN=Example TSA", "algorithm": "SHA-256" }
    }
  ],
  "summary": { "total": 1, "valid": 1, "invalid": 0, "verdict": "all_valid" },
  "verified_at": "2026-03-21T15:15:55Z",
  "verified_by": "eContract - https://verify.econtract.online"
}

  







  
Frequently Asked Questions

  

    
How do I verify a digitally signed PDF?

    
Drop the PDF on the upload area or click "Select PDF File". The tool finds every digital signature in the file and checks, for each one, that the signed bytes are unchanged, that the signature matches the signer's certificate, that the certificates embedded in the PDF form a chain, and that they are within their validity dates. No account or software installation needed.

  

  

    
Is this verification tool free?

    
Yes. You can check up to 50 PDFs a day from one IP address, without an account. The Verify API (POST https://api.econtract.online/verify-pdf) is free too, with the same limit and no API key.

  

  

    
What does the verification check?

    
Four checks per signature. Integrity: the SHA-256 hash of the signed byte range matches the digest stored in the signature, so the signed content was not changed. Signature: the RSA signature verifies with the signer's certificate. Certificate chain: each certificate embedded in the PDF is signed by the next one, up to a root. Certificate validity: the signer and chain certificates are within their validity dates today. An RFC 3161 timestamp, when present, is shown with its time and TSA.

  

  

    
Does a valid result mean the signer is trusted or the signature is legally binding?

    
No. The chain check uses only the certificates inside the PDF and does not compare the root with a list of trusted authorities (such as the Adobe AATL or the EU trusted lists), so a self-signed certificate can pass: check who issued it. Changes saved after signing as a new PDF revision lie outside the signed bytes and are not flagged. Whether a signature has legal effect depends on the jurisdiction and the type of signature; this tool reports technical facts, not legal validity.

  

  

    
Is my document stored on your servers?

    
No. The PDF is processed in memory for the check and is not stored: no copy is kept and the file is not sent to third parties. Server logs record the file name and size.

  

  

    
What signature formats are supported?

    
Signatures embedded in the PDF as CMS/PKCS#7 (adbe.pkcs7.detached, and ETSI.CAdES.detached as used by PAdES), made with an RSA key and SHA-256. Signatures that use other algorithms, for example ECDSA keys or SHA-384 digests, cannot be checked yet and are reported as invalid even when the document is intact. RFC 3161 timestamps are read and shown (TSA and time), but the timestamp token itself is not cryptographically verified.

  

  

    
Can I verify documents not signed by eContract?

    
Yes. Any PDF with an embedded CMS/PKCS#7 signature can be checked, whatever software created it, within the format limits above.

  






  
© 2026 eContract · Tamper-evident e-signatures · econtract.online · Developers · llms.txt