--- title: "Are Signed PDFs Tamper-Proof? How to Verify One" description: "A signed PDF is tamper-evident, not tamper-proof, and only if signed the right way. How to check one in Acrobat, by its hash, or by its provenance record." url: https://thedrive.ai/blog/are-signed-pdfs-tamper-proof published: 2026-10-28 updated: 2026-10-28 tags: ["e-signature", "pdf", "document integrity", "verify signature", "provenance"] author: "Bigyan Karki" publisher: The Drive AI --- # Are Signed PDFs Tamper-Proof? How to Verify One > **TL;DR:** No signed PDF is tamper-proof: anyone can edit the bytes of a file they hold. What a properly signed PDF is, is **tamper-evident**: a change after signing breaks a cryptographic check, and a verifier says so. Whether yours is depends on how it was signed. A pasted image of a signature proves nothing. A PDF with a digital signature can be checked in Adobe Acrobat's Signature Panel. A PDF from an e-signature service is checked against the service's own record, and a document hash recorded at signing can be compared with the file you have. Disclosure: The Drive AI publishes this guide and runs an e-signature and provenance service described in the last section. Everything before it works with free tools. ## Is a signed PDF tamper-proof? No, and no honest tool claims it is. A PDF is a file; whoever holds it can change it. The protection a signature gives is detection. When a document is signed cryptographically, a fingerprint of its exact bytes is sealed with a key at the moment of signing. Change one character afterwards and the fingerprint no longer matches, so the signature shows as invalid. That is what "tamper-evident" means, and it is the property courts and auditors look for. ## Which kinds of signed PDF can be verified? Three kinds look the same on screen and are very different underneath: | How it was signed | What protects it | How to check | |---|---|---| | An image of a signature pasted or drawn onto the page | Nothing. It is a picture on a page | You cannot; only the sender's records can show what was sent | | An e-signature service (an emailed link, click to sign) | The service's audit trail and a document hash, often a certificate of completion, and on many services a digital seal on the final PDF | The service's record, the certificate, or the seal in Acrobat | | A digital signature (a certificate from a certificate authority) | A cryptographic signature over the file, tied to the signer's certificate | Acrobat's Signature Panel, or any PDF validator | If you are not sure which you have, open the file in Acrobat Reader. A digitally signed or sealed PDF shows a blue signature bar at the top; a picture of a signature shows nothing. [How electronic signatures work versus digital signatures](https://thedrive.ai/blog/electronic-vs-digital-signature-difference) explains the difference in law. ## How do you check a signed PDF in Adobe Acrobat? Open the file in Adobe Acrobat or the free Acrobat Reader and open the **Signature Panel** from the bar at the top of the page. For each signature it reports one of three things: - **Signed and all signatures are valid.** The bytes covered by the signature have not changed and the certificate is trusted. - **The document has been altered or corrupted since it was signed.** Treat the file as changed. - **The signer's identity is unknown** or not trusted. The file is intact, but Acrobat cannot vouch for who signed. This is common with self-issued certificates and is not, by itself, a sign of tampering. Acrobat also shows **changes made after signing**. A PDF can be legitimately updated after a signature, for example by a second signer or a filled form field, because PDF signatures cover revisions. Use **View signed version** on a signature to see the document exactly as it was when that signature was applied. ## How do you check a PDF against its document hash? Many e-signature services record a SHA-256 hash of the final document in the audit trail or the certificate of completion. Compute the hash of the file you have and compare the two strings: ``` # macOS and Linux shasum -a 256 contract-signed.pdf # Windows (Command Prompt or PowerShell) certutil -hashfile contract-signed.pdf SHA256 ``` If the 64 characters match, the file is byte for byte the one the service recorded. If they differ by even one character, it is not the same file. Note that downloading the same envelope twice can produce two different files when a service regenerates the PDF, so compare against the hash recorded for the copy you were sent. [What is an audit trail in electronic signatures](https://thedrive.ai/blog/what-is-an-audit-trail-in-electronic-signatures) covers what else that record should hold. ## What makes a signed PDF hold up as evidence? Integrity is one of three things a court or auditor checks. The others are who signed (identity: an email, a one-time code, a certificate) and that they meant to (consent to sign electronically and the act of signing, with timestamps). A tamper-evident file with no record of who signed proves less than it looks. [Do electronic signatures hold up in court?](https://thedrive.ai/blog/do-electronic-signatures-hold-up-in-court) goes through each. ## How does The Drive AI let you verify a signed PDF? When a signature request sent with [The Drive AI's e-sign](https://thedrive.ai/e-sign) completes, the signed copy saved next to the original carries a provenance record bound into the PDF. Anyone can check it on the [provenance](https://thedrive.ai/provenance) page, in the browser, with no account. The verifier checks four things: that the record is signed by The Drive AI's published key, that the file's bytes around the record are unchanged (one byte changed or anything appended fails), that the approved document is the file's untouched prefix, and that the record appears in a public append-only log and has not been revoked. The record proves origin and integrity: this exact content, approved by this person at this time, unchanged since. It does not prove the content is true. And a file with no record is unverified, not forged. ## Frequently Asked Questions ### Can a signed PDF be edited? Yes, technically. Anyone holding the file can change it. What changes is detection: if the PDF was digitally signed or sealed, the signature shows as invalid or the change appears as a new revision in Acrobat. If the signature is only an image on the page, an edit leaves no trace. ### How can I tell if a PDF has been altered after signing? Open it in Adobe Acrobat Reader and read the Signature Panel. "Signed and all signatures are valid" means the signed bytes are unchanged; "altered or corrupted since it was signed" means they are not. For a file from an e-signature service, compare its SHA-256 hash with the one in the audit trail or certificate. ### Is an e-signature the same as a digital signature? No. An e-signature is any electronic act of signing, such as a typed or drawn signature or a click. A digital signature is a cryptographic seal tied to a certificate. Most e-signature services add a digital seal or a document hash to the final PDF, which is what makes it tamper-evident. ### What does "the signer's identity is unknown" mean in Acrobat? That Acrobat cannot trace the signing certificate to an authority it trusts. The document itself may be perfectly intact; the warning is about who signed, not whether the file changed. It is common with certificates that are self-issued or issued by an authority not on Adobe's trust list. ### Does a valid signature prove the document is true? No. A valid signature or provenance record proves the file has not changed since signing and who stands behind it. It says nothing about whether what the document says is accurate. That is a question for the parties and, if it comes to it, the court.