Tiny Online Tools
Check a signed PDF without sending it anywhere
A digital signature on a PDF answers a narrow question well: have the bytes it covers changed since it was made? PDF Signature Inspector answers that one, and three others, in your browser.
Integrity
The signature dictionary's /ByteRange names the parts of the file the signature covers — everything except the /Contents hex blob itself. The tool concatenates those ranges, hashes them with the Web Crypto API using the algorithm named in the PKCS#7 SignedData, and compares the result with the messageDigest attribute sealed inside. That is a genuine cryptographic check, not an inspection of a status flag written by whoever produced the file.
Coverage — a different question
A file can pass the integrity check and still have been changed after signing. PDF supports incremental updates: bytes appended after the signed range are invisible to the signature. So the tool also reports whether /ByteRange reaches the end of the file, how many bytes came afterwards, and which of the file's revisions this signature actually covers. Conflating these two is the most common way to misread a signed PDF.
The certificate
Subject, issuer, serial, validity window, public key algorithm and size, certificate signature algorithm, SHA-256 fingerprint, and whether the certificate was self-signed, is expired now, and was valid at the moment of signing — which is the date that matters for a signature made years ago. The whole chain embedded in the blob is listed, and any certificate can be exported as .cer (DER) or .pem.
What it cannot tell you
Trust. There is no trust store in a browser tab, so nothing here says the issuer is a certificate authority anyone recognises. Revocation is not checked — neither CRL nor OCSP — so a certificate revoked the day after signing still appears sound. An embedded RFC 3161 timestamp token is reported but not validated. These limits are shown next to the results, not only here.
Certification signatures
When a signature carries a DocMDP transform, the permission level is decoded: no changes allowed, form filling allowed, or form filling plus annotations. That is what determines whether a later edit legitimately breaks the certification.
Privacy
Signed documents are usually contracts. The file is parsed and hashed in your browser; nothing is uploaded.