How to check that a signed PDF hasn't been changed

What a fingerprint is

A SHA-256 fingerprint, also called a hash, is a 64-character code calculated from every byte of a file. Change one comma, one pixel, or even re-save the file without changing anything visible, and the code comes out completely different. Nobody can work backwards from the code to the file, or make a different file with the same code. That's why matching fingerprints prove two files are identical.

Where to find the original fingerprint

• In the completion email. When an envelope completes, the email with the signed copy shows a line called Document fingerprint (SHA-256). Every signer and the sender get it.
• On the envelope page. The sender sees the same code, labeled SHA-256, under the signed copy on the envelope page, and in its activity history.
• Inside the certificate. The certificate of completion at the end of the PDF lists an Original SHA-256 for each file as it was uploaded, before anyone signed.

Check the file

1. 1

   Save the file you were given

   Download the PDF you want to check to your computer. Don't open it in an editor and save it again, because that alone changes the fingerprint.

2. 2

   On a Mac, use Terminal

   Open Terminal, type shasum -a 256 followed by a space, drag the PDF into the window and press Return. The long code at the start of the line is the file's fingerprint.

3. 3

   On Windows, use PowerShell

   Open PowerShell, type Get-FileHash followed by a space, drag the PDF into the window and press Enter. It uses SHA-256 unless you ask for something else. In Command Prompt, certutil -hashfile followed by the file path and SHA256 gives the same result.

4. 4

   Compare the two codes

   Put the result next to the fingerprint from the completion email and compare the whole code. Letter case doesn't matter, but any other difference, even one character, means a different file.

If the codes don't match

A mismatch means the file isn't byte-for-byte the one SignMaster sealed. That doesn't automatically mean fraud. Opening and re-saving the PDF, printing it to PDF, compressing it, or an email system that alters attachments all produce a new fingerprint. The fix is to go back to the source: the signed copy attached to your own completion email, or a fresh download from the envelope with Download signed PDF. Compare the pages side by side if it matters.

Every page of a SignMaster signed PDF also carries the envelope ID and its page number, and the certificate lists who signed, their email and IP address, and when each step happened. A page with a different envelope ID, or a certificate that doesn't match the signers you know, is another sign that something's off.

What this check doesn't do

SignMaster seals documents with fingerprints, page stamps and the certificate, not with a PKI digital certificate inside the PDF. So Adobe Acrobat's signature panel won't show a certificate-based signature to validate, and there's no public verification page yet. The fingerprint check above is the way to confirm a SignMaster PDF is unchanged.