Sign For Free
Get started
← Blog

How to Verify a Signed PDF Yourself — No Vendor Required

Sign For Free Team

Can I verify a signed PDF without trusting the vendor?

Yes — and with Sign For Free you are meant to. Every completed document embeds its own cryptographic proof, and the tools that check it are open source (Apache 2.0): a browser-based verifier that runs entirely in your own browser via WebAssembly, and a Go command-line tool for offline checks. You do not have to take our word that a document is authentic. You can confirm it yourself, with software you can read and run independently. Our position is deliberately blunt: Don't trust us. Verify. This tutorial shows how.

Why independent verification matters

A verification button hosted on a vendor's website only tells you what the vendor's server chooses to say. That is a trust bottleneck. Sign For Free removes it by making verification something anyone can perform with public tools and a public key — no login, no vendor server, no permission required. If the check passes in your hands, it passes for your lawyer, the counterparty, and a court, because the math is deterministic and the same everywhere.

What you need

To verify a document you need exactly three things:

  1. The signed PDF (the completed document with its embedded Audit Trail).
  2. The signature, which is already inside that PDF.
  3. The operator's public key, published in three independent places: GitHub, DNS, and archive.org.

You do not need Sign For Free's servers, the operator's private key, or even an internet connection once you have the public key downloaded.

Option A: The web verifier (WASM, in your browser)

The fastest path, no installation:

  1. Open the Sign For Free verifier page.
  2. Load your signed PDF into the verifier.
  3. The verifier extracts the metadata and every field (type, position, rotation, value), re-serializes them deterministically (CBOR), and computes the SHA-256 fingerprint.
  4. It fetches the matching public key for the document's key ID and runs the Ed25519 verification.
  5. You get a clear PASS or FAIL.

The critical detail: the WebAssembly verifier runs the cryptography locally in your browser. Your PDF is not uploaded to a server to be checked. The verification happens on your machine.

Option B: The Go CLI (offline)

For an air-gapped or scriptable check, use the open-source Go command-line verifier. Conceptually:

  1. Install the CLI (Apache 2.0, from the public repository).
  2. Download the public key once from GitHub, DNS, or archive.org.
  3. Run the verifier against your PDF, pointing it at the downloaded public key.
  4. Read the PASS/FAIL result — no network needed after the key is local.

Because the CLI is Go and offline-capable, you can verify documents years from now on a machine that has never touched the internet, using a public key you saved today.

What a PASS actually proves

When verification passes, it establishes that:

  • The document's covered content — metadata and every field's type, position, rotation, and value — is byte-for-byte intact. Changing a stamp's angle by one degree or editing a single character would flip the result to FAIL.
  • The embedded signature was produced by the operator's private key, confirmed against the public key.
  • This holds deterministically and permanently: PASS today means PASS in ten years, for anyone who checks.

What a PASS does not prove

Verification is powerful but bounded. Be clear-eyed about the edges:

  • It confirms integrity and operator-signing under the same self-claim trust model DocuSign's standard signatures use — made independently verifiable. It is not a "qualified electronic signature."
  • The embedded time is a self-claim timestamp, not a qualified timestamp from an accredited authority. For court-grade time-of-signing trust, this is not the tool.
  • Trust in the public key rests on the operator's control of GitHub and their domain. The three-location publication (GitHub, DNS, archive.org) is what makes a quiet key swap hard, but the single-operator model is a stated one-person trade-off.

FAQ

Is the verifier really open source?

Yes. Both the web (WASM) verifier and the Go CLI are Apache 2.0 licensed and published publicly. You can read the source, build it yourself, and run it independently of Sign For Free.

Does verifying upload my document anywhere?

No. The web verifier runs the cryptography in your browser via WebAssembly, and the CLI runs locally. Your PDF stays on your machine.

Where do I get the public key, and is it safe to be public?

From GitHub, DNS, or archive.org — any of the three. It is safe and intentional for the public key to be public: it can only check signatures, never create them.

What should I do if verification FAILS?

A FAIL means the covered content does not match the signature — typically because the PDF was altered after signing, or you loaded the wrong file. Re-check that you are verifying the original completed document and its matching key ID.