How to Validate a Signature in a PDF (Free, on Phone or Laptop)

If you have opened an e-Aadhaar, a birth certificate or a GST registration certificate and seen a yellow question mark with "Signature Not Verified" in the corner, you have probably typed this exact question into Google. It is the question I built SignValid to answer: a free validator for digitally signed Indian PDFs. It went live on 29 July 2026 and had checked about 97,000 documents by 14 October 2026, so I have seen the same few doubts come up again and again.

This post answers them: what validating a signature actually checks, how to do it in a few seconds on a phone or a laptop, and what each result means for the document in your hands.

What validating a PDF signature checks#

A digital signature is not the picture of a signature or a seal on the page. It is data stored inside the PDF, made with the signer's private key, and anyone can check it with the certificate that travels with it. A full validation answers three separate questions:

1. Has the file changed since it was signed? The signature records a fingerprint of the exact bytes that were signed. If even one byte is different now, the fingerprints no longer match.
2. Who signed it, and does that lead somewhere trustworthy? The signer's certificate has to lead up, through a licensed certifying authority, to India's root certificate, which is run by the Controller of Certifying Authorities (CCA).
3. Was the certificate still good when the document was signed? Certifying authorities publish the certificates they have withdrawn (revoked), and a careful check asks them.

When all three hold, you know the file is exactly what the issuing office's system signed. A valid signature does not prove that the facts inside the document are right, or that the document belongs to the person who handed it to you. Those are jobs for the issuing portal's own verification page or the QR code printed on the document.

Why your PDF says "Signature Not Verified"#

This is the part that confuses almost everyone: the yellow question mark is a picture saved inside the file. Government portals store the "not checked yet" state in the signature box, because they cannot know which viewer will open the document later. Your phone, your browser and your printer draw that picture exactly as it is stored. None of them check anything.

Adobe Reader does try to check, but it trusts a list of certificate authorities, the Adobe Approved Trust List, that does not include India's CCA root. So on most computers it cannot finish the check either, and it shows "Validity Unknown" on a perfectly genuine document.

So a question mark tells you nothing about a document, and a green tick drawn on a page would tell you just as little. Only reading the signature data does. SignValid has a guide on why the question mark is drawn inside the PDF, and I wrote separately about how to get rid of the question mark.

How to validate a signature in a PDF, step by step#

You need the PDF itself and a browser. There is nothing to install and no account to make.

1. Open www.signvalid.in on your laptop or your phone.
2. Choose the original file: the PDF exactly as you downloaded it from the portal, from DigiLocker or from the email it came in. Not a scan, not a screenshot, and not a copy you opened in another app and saved again.
3. Type the password if the file has one. Every e-Aadhaar is locked: the password is the first four letters of your name in capitals, followed by your year of birth. e-PAN files are locked too.
4. Press Validate. SignValid reads the signature, checks the file's integrity, follows the certificate chain up to the CCA root and checks revocation where the certifying authority publishes it. It takes a few seconds.
5. Read the result. If the document passes, the preview switches from the question mark to a green tick, and you can download a verified copy.

The verified copy is the same pages with the green tick drawn where the question mark was, so it shows the result in every viewer, on phones and on paper. It is a display copy, not a signed file. Keep the original download too: that is the file that carries the signature, and it is what an office means when it asks for "the digitally signed document".

What each result means#

Most results have nothing to do with fraud. Here is what you can see, and what to do next:

• Signature valid. The file is unchanged since signing, the certificate leads up to India's CCA root, and it had not been withdrawn when the document was signed. The result names the signer and the authority behind them.
• Validity unknown. The signature is intact, but its certificate does not lead to a root SignValid trusts. On a genuine document freshly downloaded from a government portal, that usually means the portal has started signing under a new intermediate certificate, which is worth reporting. On a document from an unknown source, it can mean a self-made certificate, and that never gets a tick.
• Integrity failure. The bytes differ from what was signed. It is almost never tampering. The usual causes are opening the PDF in another app and saving it, compressing it for an upload form, or printing it to PDF. Download a fresh copy from the portal and check that one.
• Re-saved copy. The signature is still in the file, but the file was rewritten after signing, so there is nothing left to compare. Saving a PDF from Chrome's viewer is the most common cause: the new file looks identical and cannot be checked.
• No signature found. The file has no digital signature. It is a scan or a photo, or a document that was never issued as a signed file (some are checked by their QR code instead).
• Revoked certificate. The certifying authority withdrew the signer's certificate before the document was signed. This is the one result that really means something went wrong; take it up with the office that issued the document.

SignValid's guide to what each validation result means goes into every case in more detail.

Validating a signature on your phone#

On a phone the steps are the same: open signvalid.in in Chrome or Safari, choose the file from your Downloads (on an iPhone: Files, then Downloads) and press Validate. What to avoid is every phone habit that writes a new file before you check it: "Print" followed by "Save as PDF", compress apps, scanner apps, password-removal apps, and editing the PDF and saving it.

These habits are not rare. Of 116 files that people had shared with SignValid after a failed check by mid-September 2026, 52 were copies saved again after signing, and 44 of those had been written by PDFium, the PDF engine inside Chrome and many Android apps.

When you send a signed PDF on WhatsApp, attach it as a document, not as a photo. SignValid's guide to checking a signed PDF on your phone covers the rest.

Is it safe to upload my documents?#

I built SignValid around keeping nothing. A file and its password live in the server's memory for the few seconds of the check and are gone when the answer is sent: the document, its name, an Aadhaar number and the password are never stored or logged. The one exception is the "Share this file with the developer" button after a failed check, which exists so a document type that should pass can be fixed; the privacy policy says what is kept then, and for how long.

SignValid is free and is paid for by Google ads, which never see your documents. To keep it quick for everyone there is a fair-use allowance of 30 checks per 10 minutes per browser. If you have a pile of certificates, drop up to 50 PDFs at once, then download every verified copy as one ZIP, with a CSV or JSON report of the whole run.

What building a signature validator taught me#

The cryptography is the well-documented part. The real work is in the files government portals actually produce: an old signature format that several modern PDF libraries refuse to read, documents signed with certificates that had already expired by the recorded signing time, and offices whose software signs the same document twice. Each of those has to be handled honestly, without turning a genuine document red or a bad one green.

The second lesson is about failures. The most common reason a genuine document fails is not forgery, it is handling: someone opened it in Chrome and saved it, squeezed it for an upload form, or printed it to PDF. If your document fails, download it again from the portal before you worry.

And the most-checked document so far is e-Aadhaar: 21,899 checks by 14 October 2026, of which 18,615 passed.

Frequently asked questions#

Can I validate a PDF signature without Adobe Reader?#

Yes. SignValid runs the full check from the browser on any phone or laptop, with nothing to install. Adobe Reader can only finish the check after you add India's CCA root to its trusted certificates by hand, and that changes only what your own computer shows: the person you send the document to still sees the question mark.

Is the verified copy a legally valid document?#

The verified copy is a display copy. It shows the result of the check, but it carries no digital signature of its own, so the original PDF remains the signed record. Keep both, and send the original whenever an office asks for the digitally signed document.

Which documents can I check?#

Any PDF signed under India's CCA hierarchy. e-Aadhaar, e-PAN, GST registration certificates, CRS birth and death certificates, Tamil Nadu e-District certificates, Digital Gujarat certificates and Maharashtra Board marksheets have all been tested with real samples, and certificates from other states' portals use the same kind of signature.

Is SignValid a government website?#

No. It is an independent tool that I build and run, not affiliated with UIDAI, the Government of India or any state government. It checks the signatures their systems make.

If a genuine document still fails on SignValid after a fresh download from the portal, tell me: that is a bug I want to fix.