Inspect every digital signature in a PDF: signer name, certificate chain, signing time, hash algorithm and document integrity. Perfect for auditing contracts, verifying eIDAS-signed invoices and confirming an unaltered signed PDF — all in your browser.
Click to select a file or drag and drop
PDF Documents
Your files never leave your device.
Upload a trusted X.509 certificate to validate against a custom trust source.
Upload certificate (.pem, .crt, .cer)
Processing...
Drag the signed PDF onto the upload zone or pick it from your device. The file is parsed locally in your browser; nothing is uploaded.
ZentoPDF locates every /Sig field in the document and decodes the embedded PKCS#7 / CMS structure: signer name, certificate chain, signing time, hash and signed byte range.
You get a clear, per-signature verdict: signature is intact (document unaltered since signing), certificate chain is trusted (or self-signed) and signing time is plausible. Each finding includes the exact bytes inspected.
Draw, type, or upload your signature.
Add a cryptographic digital signature to your PDF using X.509 certificates. Supports PKCS#12 (.pfx, .p12) and PEM formats. Your private key never leaves your browser.
Inspect the hidden properties of your PDF.
Lock your PDF by adding a password.
Remove metadata, annotations, scripts, and more.
ZentoPDF supports the two standard PDF signature flavours: classic PKCS#7 / CMS signatures and the PAdES (PDF Advanced Electronic Signatures) family — PAdES-B, PAdES-T, PAdES-LT — which are the formats used by eIDAS qualified signatures in the EU, by many e-government portals and by enterprise document workflows.
The validator recomputes the cryptographic hash over the signed byte range and compares it to the hash stored inside the signature. If they match, the document has not been altered since it was signed; if they differ, even a single byte was changed and the signature is invalid.
Yes. ZentoPDF walks the chain from the signer up to the root, displays issuer, subject and validity dates for each certificate and flags self-signed roots versus roots from public trust anchors. For full revocation checks you should also consult OCSP/CRL servers in your IT environment.
No. All parsing and hashing run locally in your browser using PDF.js and the Web Crypto API. Your signed PDFs never leave your device, which makes the tool safe for confidential contracts and legal evidence.
Yes — 100% free, no signup, no watermark. Validate as many signed PDFs as you need, every day, for personal or professional use.