A PDF is a file of bytes, and what you see on screen is drawn from them. A changed figure, a swapped page or text laid over a signed page can look exactly like the original. So the question is never “does it look right?” It is “does it match something that was fixed when it was signed, and that the person who might have changed it could not change too?”
The short answer
- Find something to compare against. A file on its own can tell you very little about its own history.
- Fingerprint: if a SHA-256 hash of the file was recorded when it was signed, hash your copy and compare. A different file gives a different fingerprint.
- Seal: if the file carries a seal, check that it still verifies and that it still covers the whole file, not just the part that existed when it was sealed.
- Sealed by Pixasign? Drop it into pixasign.co.uk/check. It does both checks and answers in words.
- Treat the rest as clues. Dates in the file’s properties, the file name and how the pages look prove very little.
What a PDF can tell you on its own
There are five ways people try to answer the question. They are not equal.
| Method | What it can show | Its limit |
|---|---|---|
| Reading it against your own copy | An obvious difference, when the two are side by side | Only as good as your copy, and a changed figure on page 6 is easy to miss |
| File properties: dates, author, the software that saved it | Sometimes, which program last saved the file | Written by whatever saved the file, and editable in any PDF editor |
| Revisions inside the file | That something was added after the first save | Signed files normally have several, and you need a specialist tool to list them |
| A SHA-256 fingerprint | Whether two files are the same, byte for byte | Only useful if the fingerprint taken at signing came from somewhere you trust |
| A seal over the whole file | Whether the sealed bytes have changed, and when the seal was applied | Anything added after sealing needs a coverage check, and a seal alone does not say who applied it |
Fingerprints: the simplest test, if you have something to compare
A SHA-256 hash is a 64-character fingerprint calculated from every byte of a file. The same file always gives the same fingerprint. Change one character and the fingerprint is completely different. You can take one without installing anything:
- Windows: open Command Prompt in the folder and type certutil -hashfile "file.pdf" SHA256
- Mac: open Terminal in the folder and type shasum -a 256 file.pdf
Try it on the real
sealed sample we publish. Its fingerprint is
b8c8caed0e86f5c2
Two things to know before you rely on a fingerprint:
- It needs a trusted original. A fingerprint is only worth comparing against one recorded at the time, somewhere the person who might have changed the file could not reach: the copy both sides were emailed, an evidence certificate, a record held by somebody else. A fingerprint the sender gives you today only proves the file matches what they say now.
- A different fingerprint means a different file, not necessarily different words. Re-saving a PDF, printing it to a new PDF or running it through a tool that shrinks files can each make a new file with a new fingerprint, even when nothing visible has moved.
Revisions and file properties: clues, not proof
A PDF can be saved by adding to the end of the file instead of rewriting it. That is a normal feature: it is how a second person signs, and how a seal is added. The earlier version stays inside the file, and each saved revision ends with an end-of-file marker. Specialist tools can list the revisions and show what each one added.
More than one revision is not a sign that anything is wrong. The published sample contains three end-of-file markers, because sealing adds to the file rather than rewriting it.
File properties are weaker still. The created and modified dates, the author and the name of the software are written by whatever saved the file last, and any PDF editor can change them. They can point you somewhere. They cannot settle anything.
What a seal adds, and the gap it leaves
A seal is a cryptographic signature or timestamp over the bytes of the file, stored inside the file. A Pixasign seal is an RFC 3161 document timestamp from DigiCert, an independent timestamp authority, over the whole file at the moment of sealing. It is signed with DigiCert’s key, RSA-4096 with SHA-384, not a key Pixasign holds. Two things follow from how it works, and the evidence certificate prints both:
- Changing any byte the seal covers breaks it.
- Something added to the end afterwards does not. The seal over the earlier bytes stays intact. That is why a careful check also asks whether the seal still covers the whole file. Our guide to what PAdES is explains the trick in detail.
A seal also cannot say who applied it. Anybody can get a DigiCert timestamp for a file and give the field any name. So “sealed by Pixasign” is decided another way, below.
If Pixasign sealed it: the checker
Open pixasign.co.uk/check, then drop or choose the PDF, up to 25 MB. There is no account, no sign-in and no card, and the file is checked and discarded: nothing is stored. The checker compares the file with Pixasign’s record of exactly what it sealed, and you get one of three answers.
| Answer | What it means | What to do |
|---|---|---|
| Sealed by Pixasign and unchanged | This is the exact file Pixasign sealed, nothing in it has changed since, and DigiCert time-stamped the seal at the time shown | Keep the file as it is. The answer is about the file, not about who signed it |
| Sealed by Pixasign but changed since | The seal is Pixasign’s, but something in the file changed after it was sealed | Do not rely on this copy. The checker’s own advice: “Ask the sender for a fresh copy.” |
| Not sealed by Pixasign | There is no Pixasign seal on the file, or none that Pixasign has a record of | That does not make it a forgery. It may have been signed somewhere else, or not signed at all |
With a sealed answer, the checker lists four lines, all ticked: Sealed by Pixasign, not an imitation; Unchanged since it was sealed; Covers the whole file; and Time-stamped by DigiCert, with the date and the time in UK time.
One case catches people out. A copy made by printing the signed PDF to a new PDF, or by scanning a printout, is a new file without the seal, so it gets the third answer even when every word is the same. Ask for the file as it was sent, not a copy of it.
And one thing to say plainly. The checker decides “sealed by Pixasign” from Pixasign’s own records. It is our check, not an outside one. The independent part is the DigiCert time inside the file.
Try it on a real sealed file
We publish a real sealed PDF so anyone can see the checker answer yes. It is a made-up quotation, QU-2026-0188, from Example Electrical Ltd to Example Property Services Ltd. Both companies are fictional and nobody signed it: the signature on it was made for the sample. The seal is real. The file is 109,803 bytes, and DigiCert time-stamped it on 28 September 2026 at 12:42:14 UK time.
- Download the sealed sample.
- Drop it into the checker. We did this on 5 November 2026, and the answer was Sealed by Pixasign and unchanged, with all four lines ticked and the last one reading Time-stamped by DigiCert, 28 Sep 2026, 12:42:14 UK time.
- Now change a word in a PDF editor, save it, and check the edited copy. It will not come back unchanged. Depending on how the editor saves, the answer is Sealed by Pixasign but changed since or, if the editor rebuilt the file without the seal, Not sealed by Pixasign.
What a clean answer does not prove
“Sealed by Pixasign and unchanged” is a statement about bytes and a time. It is worth knowing what it leaves out.
- Who signed. Each signer is identified only by the email address their signing link was sent to. The evidence certificate adds their IP address, device and approximate location, but none of it proves who was holding the phone.
- Authority. It does not show that a signer was allowed to sign for a company.
- That it is the latest version. A variation agreed later is a separate document, with its own seal.
- That the content is right. A sealed quote with the wrong price is still the wrong price, sealed.
For the full record that comes with a sealed file, see what an e-signature audit trail looks like, line by line. For what to keep if a signature is ever disputed, see our guide to electronic signature evidence, and for the bigger picture, the guide to electronic signatures for UK small businesses.
Check a file now
Free, with no account and nothing stored. Drop in a PDF sealed by Pixasign, or the sample, and read the answer.
Check a signed document Sending documents for signature is free for 3 documents a month, no card.Questions
- How can I tell if a PDF has been edited after it was signed?
- Compare it with something fixed when it was signed. If you have the file’s SHA-256 fingerprint from that time, hash your copy and compare: a different file gives a different fingerprint. If the file carries a seal, check that the seal still verifies and still covers the whole file. For a file sealed by Pixasign, the free checker at pixasign.co.uk/check does both.
- Can the dates in a PDF’s properties show when it was changed?
- Not reliably. The created and modified dates are written by whatever software saved the file, and any PDF editor can change them. Treat them as clues. A timestamp inside a seal is different: it is signed by the timestamp authority, and checking the seal shows whether it still matches the file.
- What does “Sealed by Pixasign but changed since” mean?
- The seal is Pixasign’s, but something in the file changed after it was sealed. The checker says not to rely on that copy and to ask the sender for a fresh one. It does not say what changed or who changed it.
- Does an unchanged answer prove who signed?
- No. It proves the file is the one Pixasign sealed, that nothing in it has changed since, and when DigiCert time-stamped the seal. Each signer is identified only by the email address their signing link was sent to, so it does not prove who they really are or that they had authority to sign.
- Is the Pixasign checker independent of Pixasign?
- No, and it says so. It decides “sealed by Pixasign” from Pixasign’s own record of what it sealed. The independent part is the DigiCert timestamp inside the file, which is signed with DigiCert’s key, not ours.