Verify the digital signatures in a PDF — on your device
Digest, signature, certificate, coverage and timestamp, checked locally with a downloadable report.
Verify PDF signature now — free →Drop a signed PDF and Bindery reads every signature dictionary, recomputes the digest over the signed byte range, verifies the CMS signature against the embedded certificate (RSA PKCS#1, RSA-PSS or ECDSA, SHA-1 to SHA-512), reads the signer’s name, organisation, issuer and validity dates, and checks whether the signature covers the whole file or an earlier revision that was changed afterwards.
It also decodes RFC 3161 timestamp tokens and confirms they belong to the signature. What it deliberately does not do is claim trust: with no certificate-authority store in the browser it tells you who issued the certificate and whether it is self-signed, and leaves the trust decision where it belongs. Bindery runs entirely in your browser — your file is never uploaded, so there is nothing to delete from a server afterwards.
How it works
- Drop the signed PDF and open Verify signatures
- Every signature is checked on your device in a second or two
- Read the per-signature results or download the report
Questions people ask
What does “covers an earlier revision” mean?
PDF signatures protect a byte range. If a form was filled, a comment added or a second signature applied after signing, the file grew and this signature covers only the earlier revision — the report says so instead of calling the file “modified” or “fine”.
Why is a valid signature shown as “not chain-validated”?
Bindery has no list of trusted certificate authorities and never contacts one. It proves the file is intact and shows the issuer; whether you trust that issuer is a decision your reader or organisation makes.
Which signature types are supported?
adbe.pkcs7.detached, ETSI.CAdES.detached and adbe.pkcs7.sha1 (the CMS-based types nearly every tool writes), with RSA, RSA-PSS and ECDSA P-256/P-384 keys. Older adbe.x509.rsa_sha1 signatures are reported as unsupported.