How to Validate a Digital Signature in a PDF

By Michael Peters · Published July 30, 2026 · 7 min read

What validation actually checks

A digital signature on a PDF is not a picture of handwriting. It is a cryptographic seal: when the document was signed, the signing software computed a digest of the file's contents and encrypted it with the signer's private key, embedding the result along with the signer's certificate. Validation reverses the process — and it answers two separate questions:

• Integrity — have the bytes covered by the signature changed since it was applied? This is pure mathematics. It either holds or it does not, and no configuration on your machine can change the answer.
• Identity and trust — does the certificate that signed the document chain up to an authority your software trusts? This is a policy question, and different machines can legitimately give different answers depending on their trust lists.

Keeping those two apart explains almost every confusing validation message you will ever see. A yellow question mark rarely means the document was tampered with — it usually means your reader simply does not recognise the authority that issued the signer's certificate. If that is the situation you are in right now, we have a dedicated walkthrough: PDF signature shows “Not Verified”? What it means and how to fix it.

Method 1: Validate online (no installation)

The fastest route, and the only one that works identically on every device:

1. Open Mapsoft's free Validate Signature tool in any browser.
2. Upload the signed PDF.
3. Read the report. For every signature in the document it lists who signed (from the certificate), when, any stated reason or location, and — most importantly — whether the signature is cryptographically intact, meaning the content has not been altered since signing.

The tool reports integrity and trust separately, which is exactly the distinction that matters. A document can be reported as intact but signed with a certificate that does not chain to a trusted authority (a self-signed certificate, for instance, or a national government hierarchy) — you then know the content is unchanged and can make your own judgement about the issuer.

Method 2: Validate in Adobe Acrobat or Acrobat Reader

Acrobat validates signatures automatically when a signed document opens, and summarises the result in a bar across the top of the window. To dig into it:

1. Open the signed PDF in Acrobat or the free Acrobat Reader.
2. Open the Signatures panel — the fountain-pen icon in the left-hand pane, or via the signature bar's Signature Panel button.
3. Expand the signature entry. It shows whether the signature is valid, whether the document has been modified since signing, and the certificate details.
4. For the full story, right-click the signature and choose Show Signature Properties… — from there you can inspect the signer's certificate, its issuing chain, and the revocation checks.
5. If the status shows as unknown, right-click and choose Validate Signature to force a fresh check.

The icons decode as follows: a green tick means intact and trusted; a yellow question mark means intact but the signer's identity could not be verified against Acrobat's trust lists; a red cross means the document has been altered since signing or the signature is otherwise invalid. Only the red cross is an integrity failure.

Method 3: On a phone or tablet

A surprising gap: the Acrobat Reader mobile app does not display signature validation status at all — a signed document simply opens like any other PDF, question marks and all. If someone sends you a signed contract while you are away from your desk, the practical option is a browser-based check: open the online validator in your phone's browser, upload the file from your downloads or cloud storage, and read the same report you would get at a desktop.

Reading the results like a professional

“Signature is valid”

Integrity and trust both check out: the content is unchanged and the certificate chains to a trusted authority. For contracts and compliance documents this is the state you want to see — and if you need to demonstrate it to someone else, note that trust is evaluated per machine, so their reader may still show a question mark even when yours shows green.

“Signature validity is unknown” / question mark

The signature is intact but the certificate's issuer is not in your trust list. Common with government documents, internal company CAs, and self-signed certificates. The fix — and the judgement call involved — is covered in the companion article.

“Document has been altered or corrupted”

The one to take seriously: the bytes covered by the signature no longer match the digest. Either the file was modified after signing, or it was damaged in transit. Do not rely on the document; go back to the sender for a fresh copy.

A note on time

Certificates expire, but a signature applied while the certificate was valid does not become worthless at midnight. Well-made signatures embed a timestamp from a trusted time authority proving when signing happened, and long-term validation (LTV) data so the signature can still be verified years later, after the certificate has expired and revocation servers have moved on. If you are producing signed documents meant to outlive their certificates, insist on timestamps and LTV; if you are validating one, a valid timestamp is what lets you accept a signature whose certificate has since expired. The full machinery — certificate chains, revocation checking, embedded validation data — is covered in our deeper guide to how signature validation works.

Need to sign rather than validate?

The reverse operation — applying a digital signature — is a one-step job with Mapsoft's Sign PDF tool, and for a deeper understanding of the certificates underneath it all, see our guide to digital certificates in PDF workflows.

Frequently asked questions

How do I validate a digital signature in a PDF for free?

Two free routes: open the PDF in Adobe Acrobat Reader and use the Signatures panel, or upload the file to Mapsoft's free online validator — no installation or account needed, from any device.

Can I verify a PDF signature on my phone?

Yes — but not with the Acrobat mobile app, which doesn't show validation status. Use a browser-based validator instead: upload the PDF from your phone and read the result in the browser.

What does a “valid” signature actually confirm?

Two separate things: integrity (the signed content hasn't changed — mathematics, not opinion) and trust (the certificate chains to an authority your software recognises — a policy setting that varies between machines). A signature can be intact yet untrusted; that's a warning about the issuer, not evidence of tampering.

Why does Acrobat show a question mark on a genuine document?

Because the signer's certificate authority isn't in Adobe's default trust lists — extremely common with government-issued documents signed under national PKI hierarchies. See our fix-it guide for the step-by-step remedy.

Does validating a signature change the PDF?

No. Validation is read-only — the software recomputes a digest and compares it against the embedded signature. The file is untouched however many times you check it.