Public verifier

Verify a signed document

Upload a completed PDF. We hash the exact bytes you hold and compare them with the completion manifest that Cloud KMS signed when the envelope was sealed. Every check is reported on its own, including the signature inside the PDF itself — the one your reader shows in its signature panel.

Drop the completed PDF here, or choose it below. Nothing is stored; the file is hashed and compared.

Verifying without Code Four

Every completed envelope has an evidence package (evidence.zip) holding the original and completed PDFs, the audit ledger, the send-time snapshot, the signed completion manifest and the public key. With that package and OpenSSL, nothing on this page is required:

openssl dgst -sha256 -verify verification/public-key.pem \
  -signature audit/completion-manifest.sig audit/completion-manifest.json

shasum -a 256 completed/*   # every hash appears in the manifest

The same public key is published at /.well-known/codefour-sign.pem — compare it with the copy in the package.

The signature inside the PDF

Documents completed since 15 September 2026 also carry a PAdES signature (ETSI.CAdES.detached) made with the same Cloud KMS key under the self-issued Code Four Sign certificate, timestamped by a public RFC 3161 authority when one answered. Acrobat and other readers show it in their signature panel and flag any later edit. It is there for the reader who never visits this page; the sealed manifest above remains the evidence, and a document completed before that date has no embedded signature.