How to check if a signed PDF was changed after signing

How a PDF signature detects changes

A digital signature in a PDF covers a range of bytes: the whole file as it stood when it was signed, except the slot that holds the signature value. The PDF standard, ISO 32000, defines this range. When Acrobat validates the signature, it hashes those bytes again and checks them against the signature. If one byte in the range differs, the signature is broken.

A PDF can also grow without touching those bytes. The standard allows incremental updates: changes are appended to the end of the file, and the earlier bytes stay as they were. Each new signature is added this way. A later save that adds a comment or fills in a form field can be added the same way. Adobe's documentation describes each signed version as saved append-only, so the version that was signed stays inside the file.

So a signature covers one revision of the file: everything up to and including that signature. That gives three possible results.

What Adobe shows: intact, changed later, or broken

1. 1Open the PDF in Adobe Acrobat or Acrobat Reader.
2. 2Open the Signatures panel. In current Acrobat, select Signatures in the panel on the right. Menu names and their places differ between versions.
3. 3Expand each signature. Adobe checks every signature on its own.
4. 4Read the line about the document. It is separate from the line about the signer's identity.

The wording and the icons differ between Acrobat versions, so read the text, not only the color. A message that the validity or the signer's identity is unknown is about the certificate, not about changes. The guide to “Signature validity is unknown” covers that case.

See what was signed: View Signed Version

The middle result needs a closer look. An appended signature is normal: when two people sign, the first signature always has something after it. An appended edit to the text is a different matter.

1. 1In the Signatures panel, select the signature you want to check.
2. 2Select Options, then View Signed Version. Acrobat shows the document as it was when that signature was applied.
3. 3To have Acrobat list the differences, select Options, then Compare Signed Version to Current Version, and review the dialog that opens.

Treat the signed version as the document the signer agreed to. If the current file shows different text, amounts, form values or pages, it was changed after signing, and that signature covers only the signed version.

Fingerprint check: the exact same file

A signature check tells you whether the signed revision changed. A SHA-256 check answers a stricter question: whether this file is identical, byte for byte, to another one. SHA-256 turns a file into a 64-character fingerprint. Change one byte, even by saving the file again, and the fingerprint is completely different.

Compute the fingerprint of your copy. On a Mac, in Terminal:

On Windows, in Command Prompt:

On Windows, in PowerShell, Get-FileHash uses SHA-256 by default:

On Linux:

Compare the result with a fingerprint from a source you trust, such as the sender or the service that produced the file. Never compare it with a value that came in the same email as the file. Some tools print capital letters: case does not matter, every other character must match.

A match proves the two files are identical. A mismatch only tells you they differ, not how. To see what changed, go back to View Signed Version.

Checking without Adobe

The fingerprint check needs only the commands above, which come with macOS, Windows and common Linux systems. It does not read the signatures, so you need a trusted fingerprint to compare against.

Not every PDF viewer checks signatures. If yours has no list of signatures with a status for each, it tells you nothing about changes, however normal the pages look.

For a technical check, pyHanko, an open-source Python library, has a command line that validates every signature in a file:

It reports the integrity of each signature and the trust status of its certificate, and analyses the incremental updates added after it. Its documentation calls that last analysis experimental.

The European Commission also runs a demonstration web app of its open-source DSS library, which validates PAdES signatures. The Commission says the demo is for testing only and advises against uploading documents with sensitive content, so use it with a sample file, not a real contract.

Checking a SignClearly PDF

Every signed PDF from SignClearly carries a platform seal: an invisible digital signature that SignClearly adds over the whole final file, certificate page included, after the signer signs. It stands for SignClearly, not for a person. The seal is added as the last incremental update, so it is the last signature in the file and covers every byte before it.

Before the seal, the file carries the signer's own PAdES signature, made in their browser with a one-time key. It covers the file the signer reviewed and approved, and the seal is the only thing added after it. If Adobe notes a later change on the signer's signature, the seal accounts for it, as long as the seal itself shows no changes after it.

1. 1Open the PDF in Acrobat or Reader and open the Signatures panel.
2. 2Find the seal: the signature issued to SignClearly platform seal. It is the last one added to the file.
3. 3Check that Adobe reports no changes after the seal. Then the file is exactly the one SignClearly sealed.
4. 4If Adobe reports changes after the seal, the file was saved again after SignClearly issued it. Use View Signed Version on the seal to see the issued version, and ask the sender for the copy they downloaded from SignClearly.

If you sent the document, you can also run the fingerprint check. The document page in your SignClearly account lists the SHA-256 fingerprints of the original and of the signed file. Your downloaded copy must match the signed file's fingerprint exactly.

Adobe shows the identity behind the seal as unknown until you trust the SignClearly root, because SignClearly runs its own certificate authority, which is not on the AATL or the EU trusted lists. That does not affect the change check. The verification page shows how to trust the root.

What the certificate page adds

The certificate page at the end of the file lists the SHA-256 of the PDF you uploaded, so you can check that the original you keep is the file that was sent for signing. It also prints the audit chain head: the SHA-256 of the last event in the event log when the file was prepared for signing. Each event includes the hash of the one before it, and this value sits inside the sealed file, so the log up to that point cannot be rewritten later without the mismatch showing.

The SHA-256 of the final signed file is recorded in the event log as well. The audit trail guide explains each entry.