How to verify a signed PDF without trusting an icon

Open the file. Read sums, dates, parties, the parts that hurt. A cryptographically valid signature on the wrong text is a perfect trail of a yes you did not want. Tools will not save you from signing nonsense.

Compare with the draft in email. If they differ, stop. Not 'it is probably just layout'. Layout hides clause 11.

Page count. A scanned version with an extra page in the middle is a classic. PAdES should catch byte changes. SES-as-picture will not.

Store the receipt and the PDF in the same folder with the same date in the filename. Future you is tired. Help them.

SHA-256 of the finished PDF should match what sits on the receipt or a verification wall. On macOS: shasum -a 256 file.pdf. On Windows: Get-FileHash. If it does not match, someone saved again, sent the wrong attachment, or tampered.

The evidence pack (certificate of completion) is the log: who, when, IP, user agent, level. Read the level. If it says SES or 'not QES', believe it. Do not upgrade it in your head.

A short id and a public /v/ link is a second trail. Use it as a supplement, not as the only truth if you already suspect the sender. Two sources beat one screenshot of a green icon.

A verification wall that requires login is a worse trail than one a counterparty's auditor can open. Think about that before you pick a tool.

Open the signature panel. 'Unknown issuer' is the CA list. 'The document has been modified' is integrity. They are different. People read both as 'broken'.

The Adobe Trust List is a club membership. A house CA in a small Oslo product is not a member. PAdES can still hold against that CA. The fingerprint on the receipt is the key.

Do not 'add as trusted' in a panic on a work machine without knowing what you are doing. That is a trust decision, not a magic repair.

Do not trust that an email subject 'signed' means the hash was checked. Subjects lie as much as filenames.

Who got the link? Does the email match the person you negotiated with? A valid PAdES from 'the platform' says the file is untouched since the platform signed. It does not say the human behind the Gmail is the one you met.

QES/BankID is the identity trail. SES is the intent trail. Mix them and you think you checked more than you did.

If who matters, and it only says SES, you have a gap. Either accept the gap, or demand eID. Staring harder at Acrobat will not fix it.

Someone opened in Preview and exported. Someone sent it through a 'PDF compressor'. Someone printed. Then the hash is dead and PAdES is red for honest reasons. Ask for the original.

Certificate display expiry versus 'signed that day'. Timestamps help. Without a TSA, old files can look odd in new software. Read the dates, not only the colour.

A phone screenshot of page one. That is not a signed PDF. It is a picture. Ask for the file.

Read the text. Hash. Receipt. Acrobat details, not just the icon. Level: SES or QES. Store it all in one folder.

If something is off, stop the payment, not 'we'll fix it later'. Later is when everyone has forgotten which file was true.

Honest tools do not say QES when they mean a hash against their own CA. Believe the boring sentence. It is your checklist.

Print kills PAdES. If your archive rule is paper, the digital file is still the truth you check first. Paper is a copy. Copies lie with time.

Certified view in Acrobat is a display mode, not a statute. Third-party 'PDF signer checker' sites: do not upload your contract to a stranger for a green icon. Use a hash locally and the vendor's evidence.

If two hashes match and the text is wrong, you have verified that you agreed to nonsense. Verification is not wisdom. Read the content every time the sum hurts.

Make the check a habit the way you check an account number before a payment. Hash first when the sum is large. Text first always. A team that only watches Acrobat colour will one day pay out on the wrong agreement with a green icon. The colour was never the job.