Tools › Documents
Verify a PDF signature
Check that a digitally signed PDF has not been modified since signing, and see the signer’s certificate, signing time, timestamp and eIDAS qualified status. Runs offline.
How it works
- Nibbo reads each signature’s byte range, hashes exactly those bytes and compares the result with the hash inside the signature (CMS / PKCS#7).
- The signature itself is verified with the signer’s public key using your browser’s WebCrypto, via the PKI.js library.
- If bytes were added after the signature, Nibbo tells you whether they only add more signatures or actually change the document.
Questions
Does “intact” mean the signature is legally valid?
Not on its own. Nibbo proves the document was not altered and the signature matches the embedded certificate. It does not check the EU trusted lists (LOTL), Adobe’s trust list or certificate revocation, because those need online lookups. Use your national validation service for legal validation.
What does “modified after signing” mean?
The file has a later revision that is not covered by this signature: for example a filled-in form field, a comment, or a changed page. Many viewers still show such signatures as valid for the earlier version.
Which signatures are supported?
PAdES and Adobe PKCS#7 detached signatures with RSA or ECDSA, plus document timestamps (RFC 3161).