Read PDF Digital Signature Information

Features

• Computes the signature’s coverage: whether it reaches the end of the file, and whether it starts at the beginning
• When content was appended after signing, reports “everything after byte N” and how many bytes
• Lists the signer, signing time, reason, location and method (SubFilter)
• Lists the raw byte range so you can verify it in another tool
• Reports “cannot judge” when no valid range can be read, rather than assuming full coverage
• Says no cryptographic verification is performed on the first line of the report, rather than implying otherwise
• Nothing is uploaded and no server is involved

How to use

1. Drop in a signed PDF
2. The report gives coverage first, then the signature details
3. Check the “content was appended after signing” line — that is usually the one that matters
4. For a stronger conclusion (is the signature trustworthy?), use a dedicated verification tool or Acrobat’s signature panel

FAQ

Does it verify the signature?

No, and that is deliberate. Full verification means parsing the CMS / PKCS#7 signed data, recomputing the digest over the signed bytes, and validating an X.509 certificate chain to a trust anchor. The failure mode of getting that wrong is calling a forged signature valid, and users would act on that conclusion. So this reports facts and stops short of a verdict. For real verification use a tool built for it — Acrobat’s signature panel gives “the signature is valid” and “the certificate is trusted” as two separate findings, and that separation is exactly what is missing here.

Then what does “coverage” mean, and is it reliable?

It is reliable, because it needs no cryptography. A PDF signature records two byte ranges `[start1 length1 start2 length2]`, with the signature itself occupying the gap in between (typically the certificate and signature value). Reading those four numbers and comparing them with the file length tells you exactly which bytes the signature actually covers. When the second range stops short of the end of the file, content was appended after signing — an attachment, an inserted page, or an incremental update — and all of that falls outside the signature. That is a computable fact, not a guess.

Does “content was appended after signing” mean the file was tampered with?

Not necessarily, but it has to be looked into. Appended content really does sit outside the signature’s protection, so it could be malicious (a forged clause, a swapped image) or benign (software writing metadata after signing, or a reader leaving extra whitespace). Telling them apart means looking at what was appended — which this tool does not judge. It tells you that something follows byte N and how many bytes it is. The position here is: state the computable facts precisely and leave the professional judgement to tools that make it.

My PDF clearly has a signature on it — why does it say there is none?

Because a signature image and a digital signature are two different things. A hand-drawn signature or a red stamp on the page is just a picture, which anyone can paste in, and it carries no trustworthy information. A digital signature is a certificate and signature value written into the PDF’s structure, which can answer “who signed it” and “has it changed since”. This tool looks for the latter. A PDF can have both, or only the picture — and with only the picture, it has no signature in the structural sense.