How to check if a signed PDF was changed after it was signed

When a signed contract, invoice or certificate reaches you as a PDF, the thing you want to know is simple: is this exactly what was signed, or has someone changed it since?

That question has a precise answer, but only for one kind of signature.

The short answer

• If the PDF contains a digital signature (made with a certificate), you can prove whether it changed. The signature holds a fingerprint of the exact bytes that were signed. Any checker recalculates that fingerprint from the file in front of you; if a single character differs, the signature shows as invalid.
• If the PDF only shows a picture of a signature (drawn, typed, scanned or stamped) there is nothing to check. A picture does not record what was on the page when it was placed. You have to compare against a copy you trust, or ask the sender.

So the first job is always to find out which kind you have.

Step 1: find out whether there is a digital signature at all

Open Verify PDF Signature and drop the file in. It lists every digital signature in the file, or tells you plainly that there is none.

If it says no digital signature found, the checker also looks for things that *look* like signatures: pictures shaped like a signature, hand-drawn marks, stamps, and signature fields that were prepared but never signed. It names the page, so you know what it is referring to. None of those can prove the document is unchanged.

If you are not sure why a PDF with a visible signature has "no digital signature", What is a digital signature in a PDF explains it in plain words.

Step 2: read the verdict for each signature

Each signature gets a one-line verdict first. The four you will see most:

• Unchanged since [name] signed it: the signed content is exactly as it was. This is the answer you were hoping for.
• Unchanged since [name] signed it. Only permitted additions were made afterwards: someone later filled in a form field or added another signature, which the first signature allows. What was signed has not changed.
• Signed by [name], but the file was changed after signing: the signed part is still intact, but something was added to the file afterwards that no signature covers.
• This signature is broken: the document was changed or the signature is damaged: the fingerprint no longer matches. Do not rely on the contents.

Under the verdict, the status rows repeat the key fact on its own line: Signature: Valid means the signed part has not changed; Signature: Invalid means it has, or the signature itself is damaged.

Step 3: if something changed, see exactly what

This is the part most checkers leave out, and it is the part you actually need. When the file was changed after a signature, the result lists each change in plain words, for example:

• "Page 1: the page content was changed."
• "Page 2: a comment was added."
• "Form field “Amount” was filled in or changed."
• "Page 4 was added."
• "A later signature by [name] was added."

Then Compare the changed pages shows each affected page as signed and as it is now, side by side, so you can see the difference with your own eyes rather than trusting a sentence.

And Download the version that was signed gives you the file exactly as that person signed it, byte for byte, before any later changes. If you are ever in a dispute about what was agreed, that is the version that counts. It is the one the signature actually covers.

Why "valid signature" and "changed file" can both be true

This surprises people, so it is worth a paragraph. A PDF can be added to without rewriting what came before: new content is appended to the end of the file, and the original bytes stay exactly where they were. That is how several people can sign one document one after another, each signature covering everything before it.

It also means a file can contain a perfectly valid signature and later additions. The signature proves the earlier version is intact; it says nothing about what was appended after it. That is why the checker reports the two facts separately, and why you should always read the "changed after signing" list rather than stopping at the word "valid". There is a full explanation in Signature is valid but the document was modified.

What the check proves: and what it does not

A digital signature check proves one thing with mathematical certainty: whether the signed bytes are the bytes in your file. That is a powerful fact. But keep these limits in mind:

• It does not prove the signer is who the name says. Anyone can make a certificate with any name in it. Whether the name is trustworthy depends on who issued the certificate. See the Trust and Certificate chain rows, and How to spot a fake signed PDF.
• It does not prove the content is true. A valid signature on an invoice proves the invoice was not changed; it does not prove the goods were delivered.
• It does not settle legal status. Whether a signature counts as "qualified" in the EU, or meets a particular government's rules, depends on the certificate's issuer and on national law. Where that matters, use the official validator for that scheme as well.
• It cannot protect a file that was never signed. If the sender printed to PDF, flattened or re-saved the file, the digital signature may be gone entirely while its picture remains.

Common situations, and what to do

"The checker says no digital signature, but the sender says they signed it"

They probably did sign, with a picture, or they signed digitally and then re-saved the file in a way that removed the signature. Ask for the original file exactly as it came out of the signing software, not a copy that has been printed, scanned, merged or compressed. Any of those steps can strip a digital signature.

"The signature is valid, but there were changes afterwards"

Look at the list. A later signature or a filled-in form field is often completely normal. It is how multi-party documents work. A changed page, an added page or a new text box is a reason to ask questions. Download the signed version and compare.

"The signature is invalid"

Treat the contents as unconfirmed. Occasionally a signature breaks for innocent reasons: a program "repaired" the file when opening it, or an email system altered the attachment, so ask the sender to send the original again, directly. If a fresh copy is also invalid, the document has been changed since signing.

"I want to prove to someone else what I found"

Use Download report (PDF). It records each signature's result, every check, the changes after signing and the certificate details, together with the file's name, size and SHA-256 fingerprint. The report describes what the check found; it is not itself a signature and does not certify the document.

A two-minute routine for any signed PDF

1. Keep the file exactly as you received it. Do not open-and-save it in another program first.
2. Run it through Verify PDF Signature.
3. Read the verdict line for every signature, not just the first.
4. If anything changed after signing, read the list and compare the pages.
5. Check who issued the signer's certificate, and whether that is who you would expect.
6. Keep the report with your records.