How to check that a signed PDF has not been changed
A signed PDF is only useful if someone else can confirm, months later, that it is the same document the people signed. These are the parts of the proof, and what each one tells you.
The seal
A digital seal (PAdES) is a cryptographic signature over the whole file. If one letter changes after sealing, the seal no longer matches, and PDF readers show that the document was modified. A PDF reader may still say the sealing certificate is not in its own trust list: that is about who issued the certificate, not about whether the file changed.
The timestamp
A timestamp from an independent timestamp authority proves the file existed in this exact form at that time. It keeps the proof valid even if a certificate expires later.
The certificate of completion
The last page lists each person, what they did, when, and from which IP address and device. It is part of the sealed file, so it cannot be swapped out.
The fingerprint
A SHA-256 fingerprint is a short code computed from the file. Two files with the same fingerprint are the same file, byte for byte. The sender can see it on the document page and compare it with the one you have.
Check a PenlyDoc PDF in a minute
- Open penlydoc.com/verify. No account is needed.
- Drop the PDF on the page. The file is checked and not kept.
- You see whether the seal is intact, when it was sealed, who signed and the fingerprint.
Developers can do the same with one request: POST /api/verify with the file in a part called document.