How to check that a signed PDF is genuine and unaltered

To verify a signed PDF, open the original file (not a printout or a screenshot) in a PDF reader or validation service that checks signatures, and answer three questions: has the document changed since it was signed, who signed it and which provider issued their certificate, and was that certificate valid at the time of signing? For a qualified signature under EU law, also check that the issuer appears on an EU trusted list. A warning that the signer's identity is "unknown" usually means your software does not trust the root certificate of the chain; it does not by itself mean that the signature is forged.

What a certificate-based signature proves, and what it does not

An advanced electronic signature is uniquely linked to the signatory, is capable of identifying them, and is linked to the signed data in such a way that any subsequent change is detectable (eIDAS Art. 26). So a successful check tells you two things: the file is the one that was signed, and the certificate names a particular person.

It does not tell you that the content is accurate or that the person was authorised to sign for a company. Check authority separately, for example against the company's register entry or a power of attorney.

A simple electronic signature, such as a typed name or an "I accept" click, has no certificate to check. Its value lies in the record around it. Under UETA, a signature is attributable to a person if it was their act, which "may be shown in any manner, including a showing of the efficacy of any security procedure" (§9(a)): the e-mail address the link went to, the time, the IP address and a fingerprint of the exact document version.

Step by step in a PDF reader

1. Save the original file. Save the e-mail attachment or download to your computer. Browser PDF viewers may not validate signatures, and a copy made with "Print to PDF" no longer contains the signature: a certificate-based signature lives inside the electronic file.
2. Open it in a desktop PDF reader that validates signatures and open the signature panel.
3. Check each signature separately. The panel lists the signer, the signing time and a status for every signature in the document.
4. Open the certificate details. Look at who the certificate was issued to, who issued it, its validity dates and whether it is marked as a qualified certificate.
5. Look at changes after signing. A reader may report that the document was modified after a signature was applied. Some changes are expected, such as a second signature, filled-in form fields or added validation data; if in doubt, use the reader's option to view the version that was signed and compare.

What the result means

The European standard for validating advanced signatures, ETSI EN 319 102-1, defines three overall results (clause 5.1.1). PDF readers use their own wording, but the logic is the same:

Is it a qualified signature? Check the EU trusted lists

For a qualified electronic signature, eIDAS lists what validation must confirm (Art. 32(1)), including that:

• the certificate was, at the time of signing, a qualified certificate for electronic signatures,
• it was issued by a qualified trust service provider and was valid at the time of signing,
• the signature was created by a qualified signature creation device,
• the integrity of the signed data has not been compromised.

Whether a provider is qualified is published in the national trusted lists that every Member State must maintain (Art. 22(1)). You can search them in the European Commission's EU/EEA Trusted List Browser: note the issuer name from the certificate details and look it up. A qualified signature from any Member State is recognised as qualified across the EU (Art. 24a(1)). Certificates from outside the EU count as qualified only if recognised by an implementing act or an agreement with the EU (Art. 14), so a certificate that is qualified in its home country is not automatically qualified in the EU; it can still be an electronic signature with legal effect (Art. 25(1)).

In the US there is no equivalent list of qualified providers, because US law has no qualified tier. Verification there comes down to the certificate chain your software trusts and the evidence record around the signature.

Free tools that apply the EU rules

The European Commission publishes DSS (Digital Signature Services), an open-source library for creating and validating electronic signatures in line with eIDAS and the related standards, together with a public demonstration web app that validates signed files. The demo lets you choose the validation level, from basic signatures to signatures with long-term validation data and archival data, and its menu includes a summary of the EU trusted lists. The Commission states that the demo is for testing only and that uploaded files are transmitted to its infrastructure, so do not upload confidential contracts there.

If you need a validation result you can present as evidence, eIDAS also provides for qualified validation services: a qualified provider validates in line with Art. 32(1) and returns the result in an automated form bearing its advanced electronic signature or seal (Art. 33(1)).

Check the signing time

A signature can carry a time claimed by the signer's own computer, or a time proven by a timestamp from a trusted third party. The ETSI standard itself distinguishes a "claimed signing time" from proof of existence (EN 319 102-1, clause 5.1.1, note 2). This matters because validation asks whether the certificate was valid at the time of signing. If the certificate has since expired or been revoked, a proven time is what keeps the signature verifiable. We explain this in timestamps and long-term validation.

Documents signed with Collobr

PDFs signed in Collobr carry a verification code and a QR code that open a page on docs.collobr.com. Anyone with the code can see the original document, who signed it, when, and whether it has changed since signing, and can compare their own copy with the original byte by byte. The page shows each signature's status under the EU trusted list (eIDAS), validated with the European Commission's DSS library, and is available in English, German, French and Turkish. It is a quick first check for the other party, not a replacement for your own validation.

Short checklist

• Is this the original signed file, not a printout or a re-saved copy?
• Has the document stayed unchanged since signing, apart from expected additions?
• Is the signer the person you expected, and are they authorised to sign for their company?
• If a qualified signature is needed: is the issuer a qualified provider on an EU trusted list?
• Was the certificate valid at the time of signing, and is that time proven by a timestamp?

Also check whether the document can be signed electronically at all; see where e-signatures are valid and where they are not. For the differences between signature levels, see which e-signature you need, and for the full legal picture, our e-signature guide.