Verify a signed document

Drop any signed PDF below to verify its cryptographic seal, certificate chain, trusted timestamps, and, for documents sealed by BVRAI eSign, the integrity of the signing audit log. No account required.

Drop a PDF here, or click to choose

How verification works

The PDF's structure is checked first: every /ByteRange must tile the file exactly around its /Contents, and nothing may be appended after the outermost signature.
The seal's X.509 certificate chain (the BVRAI Document Signing certificate, issued by the BVRAI eSign CA) is validated against the pinned BVRAI eSign root.
The SHA-256 digest of the covered bytes is recomputed and compared with the signed value.
RFC 3161 trusted timestamps and the embedded revocation data (CRL/OCSP) are checked.
If the file matches a document sealed here, its envelope's hash-chained audit log is recomputed and must be intact.
The last page of every document sealed here is a certificate of completion carrying the signers' evidence, the document hashes and the audit chain head (the hash of the last audit event at seal time). It is inside the sealed bytes, so it cannot change; the stored audit log must still contain that chain head at that event.

The same signatures verify in Adobe Reader after installing the BVRAI eSign root certificate to your trust store.