Checking PDF signatures in the signatures panel

When a signed PDF lands in your inbox, the signature is only worth something if you check it. The signatures panel in PDF by Zaweba does that. Open it from View, then Signatures panel, and every signature in the document is listed and checked as valid, unknown or invalid.

What the three results mean

Valid means the document hasn't changed in a way the signature forbids since it was signed, and the certificate is one you trust. This is what you want to see.

Invalid means something is wrong. The document may have been changed after signing in a way that breaks the signature, or the signature itself doesn't hold up. Treat an invalid signature as a reason to ask questions before relying on the document.

Unknown is the most common surprise, and usually the least worrying. It typically means the signature itself is intact but the certificate isn't one you've chosen to trust yet. The fix is to decide whether you trust the signer, which is covered below.

Changes after signing

For each signature the panel lists changes made after it. On a form signed by several people, you would expect later signatures and filled fields to appear here. That's normal. What you want to watch for is anything unexpected, such as content changing after the person you care about signed.

The panel also shows the signed version, the document exactly as it stood when that person signed. If you want to know what someone actually agreed to, open the signed version. Compare files can then show you what differs between it and the current one.

Trusted certificates

Trust is something you set. You can import trusted certificates from .cer, .pem or .p7b files, which is how organisations often share the certificates their staff sign with. Or you can trust a signer straight from the panel, which suits a regular correspondent whose certificate you've confirmed some other way.

Be careful who you trust. Trusting a certificate means future signatures from it will show as valid. Check by some other route, such as a phone call or a known website, that the certificate really belongs to who it claims to.

The panel also shows the certificate itself, so you can read whose it is, who issued it and when it runs out.

Revocation checking

A certificate can be withdrawn before it expires, for instance if a key was lost. PDF by Zaweba checks revocation offline from the document, using any validation information the signer stored in it, or online if you switch that on. Offline is the default, in keeping with the app's habit of not reaching out to the internet unless you choose. If a document came with long-term validation information, offline checking usually has everything it needs.

Handling what you find

All valid and no surprising changes: you can rely on the document as far as the signatures go. Unknown: decide whether to trust the signer, then check again. Invalid, or unexpected changes after a key signature: open the signed version, compare, and ask the sender.

When you send signed documents, make your recipients' lives easier by sharing your certificate. Export my certificate saves it as a .cer or .pem file they can import.

The signatures panel turns a signature from a decoration into evidence, and in PDF by Zaweba it does that without sending your documents anywhere.