How to check whether a signed PDF has been altered

First, find out which kind of signed PDF you have

"Signed PDF" describes two very different things, and only one of them can detect a change.

• A picture of a signature. Someone drew, typed or pasted a signature onto the page. It looks signed, but nothing in the file ties that picture to the rest of the content. Anyone with a PDF editor can change a number on page 3 and the signature will look exactly the same.
• A digital signature, often called a seal. Software computed a cryptographic fingerprint of the file's bytes and signed that fingerprint with a private key. The result is stored inside the PDF. Change one byte of the signed content afterwards and the check fails.

Most e-signature services produce both at once: the visible signatures show how each person chose to sign, and a seal applied by the service at the end locks the whole file. The seal is the part that detects alteration.

To see which you have, open the file in Adobe Acrobat Reader. A digitally signed file shows a bar across the top that mentions signatures, and a Signature Panel button. If there is no such bar, the file has no digital signature and you should skip to the fingerprint method below.

Method 1: read the signature panel in a PDF reader

This check needs only the file. It works offline and does not depend on the company that produced the document still being in business.

1. Install Adobe Acrobat Reader, which is free, and open the PDF in it.
2. Read the bar at the top. It will say that the signatures are valid, that at least one signature has problems, or that at least one is invalid.
3. Click Signature Panel and expand the signature's entry.
4. Find the line about modification. A healthy file says the document has not been modified since the signature was applied. An altered one says it has been altered or corrupted since it was signed.
5. Look for the line about time. It tells you whether the signing time comes from an embedded timestamp or only from the signer's own computer clock.

What the three results mean

There is a fourth case worth knowing. PDFs can be saved with additions appended after a signature, such as a filled-in form field or a comment. A good reader reports this as changes made after signing and lets you view the signed version on its own. The signed version is the one the signature covers.

Method 2: compare the file's fingerprint

A fingerprint, or hash, is a short string computed from every byte of a file. SHA-256 is the usual choice. Two files with the same SHA-256 fingerprint are the same file for all practical purposes, and changing a single character produces a completely different string.

Compute it with a tool already on your computer:

# macOS
shasum -a 256 contract.pdf

# Windows (PowerShell)
Get-FileHash contract.pdf -Algorithm SHA256

# Linux
sha256sum contract.pdf

Then compare the result with a fingerprint you have reason to trust:

• the one printed in the service's completion email or audit certificate, if it records one;
• the one computed from the other party's copy, read out or sent over a separate channel;
• the one from your own copy saved on the day of signing.

This method works even for a PDF with no digital signature, as long as a trustworthy fingerprint exists somewhere. Its weakness is the opposite of Method 1's strength: it only tells you whether two files are identical, not what changed or when.

A mismatch does not always mean someone edited the contract. Re-saving a PDF, using "Print to PDF", or passing it through software that rewrites attachments changes the bytes while the pages look the same. If the fingerprints differ, go back to the original file as delivered and check that one.

Method 3: use the signing service's own check

Many e-signature services keep a record of each completed document and offer a page that checks a copy against it. This answers the question a reader's yellow warning leaves open: did this file really come from that service?

For documents completed with SignThis, that page is signthis.pro/verify. You drop the PDF onto the page, your browser computes the file's SHA-256 fingerprint locally, and only the fingerprint is sent. The file itself stays on your device. The page then says whether the file is byte-for-byte the sealed copy of a completed record, and shows the record code and completion time. The completion email for every SignThis document includes the record code, the fingerprint and a link to this check.

Keep in mind what a service's page cannot do. If the service shuts down, the page goes with it. That is why a seal you can check offline, as in Method 1, matters: the evidence travels inside the file.

What an intact seal proves, and what it does not

An intact seal proves that the file has not changed since the moment it was sealed. If the seal includes a timestamp from an independent timestamp authority, following the RFC 3161 standard, it also shows that the file existed in that form at that time, without relying on anyone's computer clock.

It does not prove who the signers are. That rests on the audit record: how each person was reached and authenticated, such as a personal link sent to their email address or an access code, and what they did. Control of a mailbox shows control of that mailbox. It is not, by itself, proof of a person's real-world identity.

So a careful check has two parts: is the file intact, and does the audit record show the signers were reached the way you expected?

If the check fails

1. Do not rely on that copy. Treat it as unverified until you have compared it with an original.
2. Get the file from the source. Download it again from the signing service or the completion email, not from a forwarded message or a shared folder.
3. Check the new copy with Method 1. If it passes, the earlier copy was changed or damaged along the way.
4. Compare the two versions to see what differs, and keep both files along with the audit certificate.
5. Ask a lawyer if money or a dispute depends on the answer. This article explains how the checks work. It is not legal advice.

Common questions

Can a signed PDF be edited without anyone noticing?

If it only carries a picture of a signature, yes. If it carries a digital signature or seal, an edit to the signed content shows up as an invalid signature in a reader that validates signatures, and additions appended afterwards show up as changes made after signing.

Does a yellow warning mean the document was tampered with?

Usually not. It most often means the reader does not recognize the authority that issued the signing certificate. Open the signature's details and read the modification line. "Not modified" with an unknown signer is an intact file from a sealer your reader cannot name.

Why do two copies that look identical have different fingerprints?

Because a fingerprint covers every byte, including parts you cannot see. Re-saving, printing to PDF or adding a comment all change the bytes. Compare the files exactly as they were delivered.

Is the date printed next to a signature reliable?

A date typed on the page is just text. A signing time taken from the signer's computer clock is only as reliable as that clock. A timestamp from an independent authority, embedded in the seal, is the strongest of the three.

How does SignThis seal its documents?

Every completed document is sealed with a digital signature and an RFC 3161 timestamp, and every step is written to a hash-chained audit trail. The details are in how SignThis seals a signed document.