How to check a signed PDF hasn't been tampered with
Electronic vs digital signatures, SHA-256 fingerprints and audit trails: how to prove a signed PDF is authentic and unchanged, explained in plain English.
A signed contract is only as useful as your ability to prove two things later: who signed it, and that nobody changed it afterwards. With paper, you'd look at the ink and the initials on each page. With a PDF, you use cryptography and records. Here's how each piece works and how to check it.
Electronic signatures vs digital signatures
These terms get used interchangeably, but they mean different things:
- An electronic signature is a legal concept: a typed name, drawn signature or click that a person adopts with intent to sign. It's what makes the agreement binding under laws like the ESIGN Act, UETA and eIDAS.
- A digital signature is a cryptographic seal. Software computes a hash of the document and signs it with a private key, embedding the result and a certificate in the PDF (the PKCS#7 / CMS format). Any later change breaks the seal.
You want both. The electronic signatures show each person agreed; the digital signature proves the final file is the one they agreed to.
Check 1: the PDF digital signature
- Open the signed PDF in Adobe Acrobat Reader (free).
- Look for the blue bar at the top, or open the Signature Panel.
- Expand the signature to see its details.
Two results matter. "Document has not been modified since this signature was applied" means the file is intact. If instead Reader warns that the document has been altered or corrupted, something changed after sealing and you shouldn't rely on that copy.
You may also see that the signer's identity is "unknown" or "not trusted." That's about whether the certificate is on Adobe's trust list on that computer, not about tampering. The integrity result is the one that tells you whether the content changed.
Check 2: the SHA-256 fingerprint
A SHA-256 hash is a 64-character fingerprint of a file. Two properties make it useful:
- The same file always produces the same fingerprint.
- Change a single byte, even a space, and the fingerprint is completely different.
When Parapho seals a completed document, it records the file's SHA-256. To check a copy later:
- Go to /verify.
- Drop in the PDF. Your browser computes the fingerprint locally; only the fingerprint is sent, never the document.
- If it matches a sealed record, you'll see the document's signers and when it was completed. If not, the file isn't the sealed original.
You can also compute a fingerprint yourself and compare it with the one printed on the certificate:
# macOS / Linux
shasum -a 256 "contract - signed.pdf"
# Windows (PowerShell)
Get-FileHash "contract - signed.pdf" -Algorithm SHA256Check 3: the certificate of completion and audit trail
The digital signature and fingerprint prove the file hasn't changed. The certificate of completion answers who did what and when. A Parapho certificate is appended to the signed PDF and includes:
- Every signer and witness, with name, email and role
- Their signature image
- When they viewed, consented to sign electronically, and signed
- The IP address and browser or device used for each action
- Fingerprints of any files signers attached
- The full audit trail, from "sent" to "completed," including reminders, declines and voids
Because the certificate is part of the sealed PDF, it's covered by the same digital signature and fingerprint. Nobody can quietly edit the audit trail without the checks above failing.
What to do if verification fails
- Re-download the original from the platform or the completion email. Email clients, scanners and "print to PDF" all rewrite the file and change its fingerprint, even if it looks the same.
- Don't "fix" and re-save a signed PDF in an editor. Adding comments or filling fields after sealing changes the bytes.
- Ask the sender for the sealed copy if you received the document through a third party.
The short version
| Question | What answers it | How to check |
|---|---|---|
| Has the file changed since signing? | PDF digital signature | Adobe Reader's Signature Panel |
| Is this the exact sealed file? | SHA-256 fingerprint | /verify, or shasum -a 256 |
| Who signed, when and from where? | Certificate of completion | The last pages of the signed PDF |
Every document completed in Parapho gets all three, on every plan. Start free and send your first envelope in a couple of minutes.
Frequently asked questions
What's the difference between an electronic signature and a digital signature?
An electronic signature is the legal concept: any mark or action, such as a typed name or a click, adopted with intent to sign. A digital signature is a cryptographic technique that binds a document to a certificate and detects any later change. Good e-signature platforms use both: an electronic signature from each signer, and a digital signature over the finished PDF.
What is a SHA-256 hash?
SHA-256 is a cryptographic hash function. It turns any file into a 64-character fingerprint. The same file always gives the same fingerprint, and changing even one byte produces a completely different one, so matching fingerprints prove the file is identical.
What is a certificate of completion?
A page or document appended to a signed agreement that lists each signer and witness, their email, the time they viewed and signed, their IP address and device, their signature image, and the full audit trail of events such as sent, viewed, consented, signed and completed.
Why does Adobe say the signature validity is unknown?
Adobe checks two things: whether the document changed after signing, and whether it trusts the certificate that signed it. "Unknown" usually means the document is intact but the signing certificate isn't on Adobe's trust list on that computer. The integrity part, whether the document has been modified, is the key check for tampering.
Can I verify a document without uploading it?
Yes. Parapho's verify page computes the SHA-256 fingerprint in your browser and sends only that fingerprint to look up the sealed record. The document itself never leaves your device.
This article is general information, not legal advice. Rules differ by country, state and document type; check with a lawyer for anything high-stakes.