Verify PDF Digital Signatures Online

Check every digital signature in a PDF: integrity, edits after signing, signer (MST / CCCD), signing time, timestamp and chain to Vietnam's Root CA.

Result

Press “Run” to see the result.

Upload a signed PDF (contract, e-invoice, official letter, report) and get every signature and document timestamp it contains. For each one the API checks the integrity of the signed bytes (the message digest of the /ByteRange), the CMS / PKCS#7 signature with the signer certificate, and whether bytes were added after it (modified_after_signing: later revisions are normal for a second signature or LTV data, but worth looking at). document_unchanged_since_last_signature tells whether the last signature covers the whole file.

The signer certificate is decoded: name, organisation, tax code (MST) or citizen ID (CCCD / CMND) from the subject, issuing CA, serial number, validity and whether it was valid at the signing time. The signing time comes from an RFC 3161 timestamp when there is one (its imprint and signature are checked), otherwise from the signed attributes or the time claimed in the PDF. The chain is built from the certificates in the signature plus the root and CA certificates published by the Vietnam National Electronic Authentication Centre (NEAC, rootca.gov.vn: VNPT-CA, Viettel-CA, BkavCA, FPT-CA, MISA-CA and every licensed public CA) and the Government specialised CA (Ban Cơ yếu Chính phủ); every link is verified cryptographically, and trusted_root is true when it ends at one of these roots.

Revocation is not checked (no OCSP / CRL request): the CRL and OCSP URLs of the certificate are returned so you can check them yourself. The result is a technical check, not a legal validation of the document. Supported: adbe.pkcs7.detached, ETSI.CAdES.detached, adbe.pkcs7.sha1 and ETSI.RFC3161 document timestamps; RSA and ECDSA.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/pdf-sign-verify" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "0=@./my-file"

const form = new FormData();
form.append('0', fileInput.files[0]);

const res = await fetch('https://apibox.io.vn/v1/pdf-sign-verify', {
  method: 'POST',
  headers: { Authorization: 'Bearer YOUR_API_KEY' },
  body: form,
});
console.log(await res.json());

import requests

res = requests.post(
    "https://apibox.io.vn/v1/pdf-sign-verify",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    files={"0": open("my-file", "rb")},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/pdf-sign-verify');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
    CURLOPT_POSTFIELDS => ['0' => new CURLFile('my-file')],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Does it check revocation?

No. The certificate CRL / OCSP addresses are returned in revocation_urls; check them if your process requires it. The result notes revocation_checked: false.

Which certification authorities are trusted?

The roots published by NEAC on rootca.gov.vn (Vietnam National Root CA, G3 and the 2025 roots) with all licensed public CAs, plus the Government specialised CA (Ban Cơ yếu Chính phủ). The list is refreshed weekly.

Is my PDF stored?

No. The file is processed in memory for this request only and is not kept.