How to verify an electronic signature

Nearly every signing tool appends a certificate or completion record to the end of the completed PDF, so scroll there first. It should list every signer by name, the email address or mobile number their signing link was sent to, when each one opened and signed, and the network address and device recorded for the session. It should also print a fingerprint of the document and name the service that produced the record.

If there is no certificate page at all, you are holding either a document signed by pasting an image into it or one exported without its record. Neither is automatically fake, but you have nothing to check, so ask the sender for the completed file from the signing service. Red flags: a signer with no contact channel listed, times that run out of order, or a title and page count that do not match the file.

A hash, usually SHA-256, is a 64-character fingerprint computed from every byte of a file; change one character and the whole fingerprint changes. A good certificate prints two: the hash of the original document, which ties the signatures to the exact text that was signed, and the hash of the completed, sealed PDF, which lets you prove the copy in your hand is the copy that was issued.

You can compute a file's hash without installing anything. On Windows, open a command prompt and run certutil -hashfile yourfile.pdf SHA256. On a Mac or Linux, run shasum -a 256 yourfile.pdf in a terminal. Compare it with the certificate, character for character. A mismatch does not always mean fraud: re-saving a PDF, printing it to PDF, or letting an email client flatten it produces a different file. It does mean the copy you hold is not the issued copy, so get the original bytes before relying on it.

Every signature applied through Signathing carries a small stamp beside it with the date, the time, and a 16-character verification code in four groups of four. The alphabet leaves out the characters people confuse (O, I, L, 0 and 1), and there are 31 to the 16th power possible codes, so nobody can guess one. The same codes are listed on the certificate pages at the end of the PDF.

Go to signathing.com/verify and type the code. You do not need an account. If the code is genuine, the page shows the signer's name and role, the document title, the time it was signed, the envelope number and status, the SHA-256 of the original document, the SHA-256 of the completed PDF, and the document's evidence fingerprint.

Then drag your copy of the PDF onto the page. Your browser hashes the file locally, the file never leaves your computer, and the page says whether your bytes match the completed PDF, the original document, or neither. That is the whole check for most people. If no signature matches the code, check for typos first; if it still does not match, the document was not completed through Signathing or the stamp was copied onto it from elsewhere. Treat it as unverified.

A verified signature proves that someone with control of a particular email address or phone number opened a particular document and signed it at a particular time, and that the file has not changed since. It does not, on its own, prove that the person at the keyboard was the person named rather than someone with access to their inbox. When identity matters, look for an access code event or an in-person signing record on the certificate, and weigh the surrounding facts as you would with a paper signature that arrived by mail.

Verification also says nothing about whether the contract itself is any good. For what the law does and does not cover, read the plain-English guide to electronic signature law.