PDF · 6 min read
How to Check a Digital Signature in a PDF — and What "Validity Unknown" Really Means
A signed contract, an offer or a certificate arrives as a PDF. Is the signature real, and has anything been changed since it was signed? PDF readers answer with green checks, yellow warnings and the puzzling "validity unknown". This guide explains what you are actually looking at.
You can follow along with Toolula's Verify PDF Signature, which checks every signature in the file locally in your browser, without uploading it.
A signature image is not a digital signature
Many "signed" PDFs contain only a picture: a scanned handwritten signature or one drawn with a finger. It looks convincing, but anyone can copy it, and it says nothing about whether the document was changed afterwards.
A digital signature is cryptographic data stored in a signature field. It contains a fingerprint (hash) of the signed bytes, encrypted with the signer's private key, plus the signer's certificate. A checker recomputes the fingerprint and compares. If the PDF has no such field, there is nothing to verify, which is exactly what a checker should tell you.
Two separate questions: intact, and trusted?
Integrity asks whether the signed content is unchanged and whether the signature matches the certificate. That can be decided from the file alone. Trust asks whether the certificate really belongs to the person or company it names. That needs a trusted issuer: Adobe Reader and Acrobat show a green check only when the certificate chains to the Adobe Approved Trust List or the EU Trusted Lists, and they check revocation online.
That is why a self-signed or in-house certificate produces "validity unknown": the content may be perfectly intact, but the reader cannot confirm who signed. Toolula's checker answers the integrity question and states plainly that it does not judge trust.
Reading the result
Each signature in the report shows one of three states, along with details that help you judge it.
- Intact: the signed bytes are unchanged and the signature matches the certificate
- Broken: the content no longer matches; the file was altered or damaged
- File changed after this signature: something was appended later, such as another signature or a filled-in field
- Timestamp with an authority's name: the signing time comes from a time-stamp service, not the signer's clock
- Self-signed: the certificate vouches for itself, so identity can't be confirmed
Check without uploading the contract
Many online signature checkers ask you to upload the document, which for contracts and offers means handing confidential terms to a third party. Toolula reads the file in your browser tab instead. When a qualified electronic signature must hold up formally, for example in court, also check it in a PDF reader that consults the trust lists, or with the EU's DSS validation service.
Frequently asked questions
Is a signature with "validity unknown" invalid?
Not necessarily. It usually means the document is intact but the signer's certificate is not on a trust list the reader knows, as with self-signed or company certificates. Whether that is acceptable depends on what the signature has to prove.
What is the difference between simple, advanced and qualified electronic signatures?
Under eIDAS, a simple signature is any electronic sign of approval, such as an image. An advanced signature is uniquely linked to the signer and detects changes, like a PAdES signature with a personal certificate. A qualified signature additionally uses a qualified certificate on a secure signature device and is legally equivalent to a handwritten one.
Does adding my own signature break the existing ones?
Not when it is appended as an incremental update, which Toolula's Digital Signature does. The earlier signatures stay intact for the part they cover; checkers then note that the file was extended afterwards.
Can I check a signature on my phone?
Yes. Open Verify PDF Signature in your phone's browser and choose the PDF from your downloads or mail app. The check runs on the phone.