- Checking a signature costs nothing. You need neither paid software nor Adobe Acrobat: a free online validator or the free Adobe Acrobat Reader is enough.
- A signature is checkable because it carries its own evidence: a fingerprint of the document, a certificate and, ideally, a timestamp.
- A validator answers four questions: is the document unchanged, who signed, was the certificate valid at that moment, and which level is the signature.
- Unlike ink on paper, an electronic signature breaks visibly the moment a single character changes.
Ahandwritten signature asks you to trust it. An electronic signature lets you check it. That is the whole difference, and it is why every serious electronic signature comes with everything a stranger needs to verify it, without asking the signer, the sender or the provider that made it.
The short answer: free, no software to buy
Do I need paid software? No. Checking a signature is free. Signing is the part that costs money, because a trust service provider has to verify identities and stand behind its certificates. Checking only reads what is already in the file.
Do I need Adobe Acrobat? No. The free Adobe Acrobat Reader checks signatures reliably, and it is one option among several. A web-based validator works in any browser, on any device, and many walk you through each check in plain words.
So you have three routes, from quickest to most formal:
- An online validator. Upload the PDF and read the report. Ours is the free PDF signature check: no account, and the file is not stored.
- Adobe Acrobat Reader. Open the PDF and look at the Signatures panel. We explain each step in Check a signature in Adobe Reader.
- A qualified validation service. When you need a result that itself carries legal weight, for a court or an authority, some trust service providers offer validation as a qualified service under eIDAS.
What makes a signature checkable
A signature can only be verified if it brings its own evidence. Think of a wax seal on a letter, with a notarised copy of the sender’s ID card attached and a post office stamp showing the date. A modern electronic signature has all three, in digital form:
- 1A fingerprint of the document
Signing software first calculates a hash: a short value derived from every byte of the file. Change one comma and the fingerprint changes completely.
- 2A seal over that fingerprint
The fingerprint is then sealed with the signer’s private key, a key only they control. Anyone can open the seal with the matching public key, but nobody can forge it without the private one.
- 3A certificate that names the signer
The public key travels in a certificate: a digital ID card issued by a trust service provider after it has verified the signer’s identity. The provider signs the certificate in turn, so it can be traced back to its source.
- 4A timestamp from an independent clock
A timestamp authority confirms when the signature existed. Without one, the time comes from the signer’s own computer, which anyone can set to any date.
- 5The proof for later
With long-term validation (LTV), the file also stores the certificates and revocation answers that were valid at signing time, so the signature can still be checked once those certificates have long expired.
In a PDF, all of this sits inside the file itself, in an open European standard called PAdES. That is why any validator can read it: you do not depend on the software, or even the company, that created the signature.
What a validator actually does
A validator is a program that reads the evidence inside the file and tests each piece of it. It does not trust the document’s own claims: it recalculates, traces and asks. In the order a good validator works:
- 1Recalculate the fingerprint
The validator computes the hash of the document again and compares it with the one inside the signature. If they match, not a single bit has changed since signing.
- 2Open the seal
With the public key from the certificate, it checks that the seal was really made with the matching private key.
- 3Follow the certificate chain
It traces the certificate up through its issuers to a root it trusts, typically one on the EU Trusted Lists or Adobe’s AATL.
- 4Ask about revocation
It asks the issuer whether the certificate had been revoked, and compares the answer with the moment of signing.
- 5Confirm the time
It checks the timestamp, so the question “valid when?” has an answer that does not depend on anyone’s word.
- 6Determine the level
From the certificate and the Trusted Lists it tells you whether the signature is qualified (QES), advanced (AdES) or neither.
The EU Trusted Lists deserve a word. Every member state publishes an official, signed list of the trust service providers it supervises, and the European Commission links them all in one list of lists. When a validator says “qualified”, this is where it looked it up: not in the provider’s marketing, but in a register kept by the supervisory authorities.
How revocation works
A certificate can be cancelled before it expires, much like a bank card you report lost. Perhaps a key was compromised, a person left the company, or details on the certificate were wrong. The issuer then revokes it, and from that moment it should no longer be used to sign.
Validators find out in one of two ways:
- A revocation list (CRL). The issuer regularly publishes a signed list of every certificate it has revoked. The validator downloads it and looks for the certificate in question.
- A live query (OCSP). The validator asks the issuer directly about one certificate and receives a signed answer: good, revoked, or unknown. If revoked, the answer includes when.
The “when” is what matters. A certificate revoked after the signature was made does not undo that signature: on the day of signing, the certificate was sound. A certificate revoked before is a different story. This is exactly why the timestamp is so valuable: without a trusted time, nobody can say on which side of the revocation the signature falls.
Reading the result
Most validators boil their findings down to one of three answers. Each one says something precise, and something it does not:
| Result | What it means | What to do |
|---|---|---|
| Valid | The document is unchanged, the certificate leads to a trusted source and was sound at signing time. | Nothing. This is the normal result. |
| Not trusted / unknown | The document is intact, but the validator does not know the certificate’s issuer, often a company-internal or foreign certificate. | Confirm the signer by another channel, or check with a validator that uses the EU Trusted Lists. |
| Invalid | The document was changed after signing, or the certificate was revoked before the signature was made. | Do not rely on it. Ask the sender for the original. |
One limit applies to every validator: it checks the signature, not the deal. “Valid” tells you who signed, what they signed and when. It does not tell you whether the content is true, or whether the signer was authorised to bind their company. That part stays with you, or with your lawyer.
Why an electronic signature beats a handwritten one
It is tempting to see the electronic signature as the convenient copy of the real thing. Technically, it is the other way round. A signature in ink proves surprisingly little, and proving even that takes an expert.
| Question | Handwritten | Electronic (QES) |
|---|---|---|
| Was the text changed? | Swap page 3 of a stapled contract and nobody notices. | Any change to a single character breaks the signature, visibly. |
| Who signed? | A squiggle, compared by eye or by a handwriting expert. | A certificate issued after an identity check by a supervised provider. |
| When? | Whatever date was written next to it. | A timestamp from an independent, trusted clock. |
| Who can check? | An expert, with the original paper. | Anyone, with a free validator, in seconds, from any copy of the file. |
The law has drawn its conclusion. Under Article 25(2) of the eIDAS Regulation, a qualified electronic signature has the same legal effect as a handwritten signature in every EU member state. In practice it is the stronger of the two: easier to check, and far harder to dispute.
“Ink can be imitated. A qualified electronic signature can only be checked, and it checks out or it does not.”
Which validator to use
All good validators test the same evidence. They differ in which trust lists they consult, how they explain the result and what happens to your file:
- swipesign PDF signature check: free, no account, the file is processed in memory and not stored. Checks against the EU Trusted Lists and Adobe’s AATL, including revocation, timestamps and the qualification level, with a report in plain language.
- RTR signature check (Austria): the Austrian supervisory authority is required by law to offer a free service for validating qualified signatures and seals. A natural choice for documents signed with an Austrian certificate or an official signature.
- European Commission DSS demo: built on the Commission’s open-source validation library, with very detailed reports. The Commission presents it as a demonstration for testing, so avoid uploading sensitive documents.
- Adobe Acrobat Reader: free, offline, already installed on many computers. It shows the result in the Signatures panel, with the details in each signature’s properties.
- Swisscom Validator: for signatures under the Swiss Signature Act (ZertES), this is the right place to check.
Whichever you choose, a check takes less than a minute. If a signed document matters to you, check it. That is what the signature is there for.
Adobe, Acrobat and Reader are trademarks or registered trademarks of Adobe Inc. in the United States and/or other countries. swipesign is not affiliated with or endorsed by Adobe.
Sign with QES or AES, verifiable by anyone.
swipesign signs in the open PAdES standard with a qualified timestamp, so any validator can confirm your documents, today and in twenty years.