Inspect a PDF for signature fields, count signature markers, and analyze the ByteRange integrity window.
Inspect a PDF for signature fields, count signature markers, and analyze the ByteRange integrity window. Inspect a PDF for signature fields, count signature markers, and analyze the ByteRange integrity window.
A digital signature on a PDF is not a stamp drawn on the page (though a visual signature appearance may exist too). It is a cryptographic object: a signature dictionary whose /Contents value holds a DER-encoded PKCS#7 SignedData structure. That structure contains the signer's certificate, the digest algorithm, and a signature computed over a precise slice of the PDF bytes. The /ByteRange array in the signature dictionary describes exactly which byte ranges of the file are covered by the signature: typically [0, a, b, c] meaning "bytes 0..a-1 and b..b+c-1". Everything inside those ranges is signed; everything outside -- the signature value itself -- is not. This design lets a PDF be signed without knowing its final length in advance.
To verify a signature, a checker hashes the bytes in the signed ranges and compares them against the digest embedded in the PKCS#7 structure. If someone edits the PDF after signing, the covered bytes change, the recomputed hash diverges, and verification fails -- that is the tamper signal. The /ByteRange therefore defines the integrity window: a signature can only protect the bytes it covers. A signature whose ranges do not cover the whole document leaves the rest of the file open to undetected modification. This checker reports whether the range is present and whether it starts at byte 0 and covers head plus tail -- the shape every signing tool produces.
It parses the PDF with the bundled pdf-lib library (Apache-2.0) and reports: the page count; the number of signature fields found in the AcroForm; the number of /FT /Sig markers in the raw byte stream; whether a /ByteRange array exists; and whether that range has the canonical [0, head, tailStart, tailLen] shape. A PDF with zero markers has no signatures at all. A PDF with markers but no parseable range is unusual and worth a closer look. Full cryptographic verification -- recomputing hashes and validating the certificate chain -- requires the signer's complete chain and a trust store; this page focuses on the structural analysis that reveals whether signatures exist and whether the integrity window is intact.
More than one signature marker usually means multiple signatures or an incremental update that re-signed the document. An encrypted PDF may hide signature dictionaries from the parser; ignoreEncryption mode is used so the structure is still reported. Remember: this tool checks structure, not identity. It cannot tell you whether the signer is who they claim to be -- that requires verifying the certificate against a trusted root. Use it as a first-pass triage on documents you receive, then follow up with your platform's full signature verification for anything important. The analysis runs entirely in your browser; your PDF is never uploaded.