Free tool
Find out whether the digital signatures in a PDF are valid — who signed, whether the document changed afterwards, whether Adobe Acrobat will trust it, and whether it will still verify in ten years. The same checks Acrobat runs, explained in plain English.
Trust lists: Adobe AATL snapshot of 2026-10-15 and the Mozilla root store of 2026-10-20.
The checker needs JavaScript and a current browser (Chrome, Edge, Firefox or Safari).
What it checks
Each signature gets a verdict — valid, validity unknown, or invalid — and the reason behind it.
Re-computes the hash of the signed byte range and verifies the RSA, RSA-PSS or ECDSA signature, so you know whether a single byte changed after signing.
Finds incremental updates appended after each signature and tells you what they contain: another signature, LTV data, comments, form values or page content.
Builds the certificate chain and checks it against the Adobe Approved Trust List and the public root store — the difference between a green tick and “validity unknown”.
Verifies RFC 3161 timestamps: the token must match the signature value and be signed by the time-stamp authority. Shows the proven signing time.
Reports embedded OCSP/CRL data and the Document Security Store, and can ask the CA live whether a certificate has been revoked.
PAdES vs legacy PKCS #7, SHA-1 and weak keys, certification (DocMDP) permission level, reason, location and contact recorded by the signer.
Privacy
Contracts, invoices and HR files are exactly the documents people need to verify — and exactly the ones that should not be uploaded to a stranger’s server. So the checker does all of its work inside your browser tab:
Browsers are not allowed to query certificate authorities directly, so for the optional revocation check our server relays the request. It receives the signer’s public certificates — the same data printed in the PDF’s signature panel — and nothing else. Switch online checks off to keep everything offline.
| The PDF, its text or pages | Never |
|---|---|
| File name and size | Never |
| Signature values and hashes | Never |
| Public certificates (signer, issuer) | Only with online checks on |
Signing a lot of PDFs?
OneSigner turns the certificate on your YubiKey, SafeNet or ePass token into a signing service: REST API, watched folders and eSign envelopes, with PAdES signatures, RFC 3161 timestamps and LTV that pass every check on this page.
Seeing “validity unknown”?
Signatures from certificates on the Adobe Approved Trust List show a green tick in Acrobat and Reader for every recipient, with no setup on their side. We supply document-signing certificates on hardware tokens.
FAQ
No. The PDF is opened by JavaScript inside your browser tab; parsing, hashing and signature verification all run locally with the browser’s WebCrypto engine. If you leave online checks switched on, only the signer’s public certificates are sent to onesign.sg so the server can ask the certificate authority whether they are revoked — the document itself never leaves your device.
Acrobat only trusts certificates that chain to the Adobe Approved Trust List (AATL) or to a certificate the reader has trusted manually. A signature can be mathematically intact and the document unchanged, yet still show “validity unknown” because the signer’s certificate comes from a CA that is not on the AATL, is self-signed, or the issuing certificates are missing from the file. Read the fix →
The AATL is the list of root and intermediate certificate authorities that Adobe Acrobat and Reader download and trust by default for document signatures. Certificates issued under an AATL member show a green “Signature is valid” check in Acrobat for every recipient without any setup. This checker uses a snapshot of the list published by Adobe; the date is shown above the results.
Long-term validation (LTV) means the PDF carries everything needed to validate the signature years later: a trusted RFC 3161 timestamp proving when it was signed and the OCSP responses or CRLs proving the certificate was not revoked at that time. Without them, the signature becomes hard to validate once the certificate expires or the CA’s servers change. How to enable LTV →
Yes, if the changes were appended as an incremental update. The signed revision is still intact and verifies, but the later changes are not covered by that signature. Adding another signature, a document timestamp or LTV data is normal; new page content, comments or form values deserve a closer look, and a certification signature may forbid them. When Acrobat says “altered or corrupted” →