BASALT · JOURNAL
Verifying a digital signature on a PDF
A digital signature on a PDF proves two things and is frequently assumed to prove several others.
What it proves
That the document has not changed since it was signed, and that the signing was done with a particular certificate.
What it does not prove
That the person named actually signed it, unless the certificate was issued in a way that verified their identity. A self signed certificate proves only that whoever signed had the certificate.
That the content is true, or that the signer read it.
That the document is safe. A signed PDF can carry metadata, attachments and hidden content exactly like any other, and signing a document that was never sanitised produces a signed document with all the same leaks.
Checking one
Preview shows signature status when a document carries one, and Adobe Reader gives more detail, including the certificate chain and whether it is trusted.
What to look at: whether the document has been modified since signing, who issued the certificate, and whether that issuer is one you have reason to trust. An unfamiliar issuer is not automatically suspect, but it is the thing to check rather than the green tick.
Incremental updates
A signed document that is later modified usually gains an incremental update, so the signature covers an earlier revision and the current content differs.
Good viewers report this clearly as signed then modified. If you are checking something important, count end of file markers as well: more than one means multiple revisions exist in the file.
A signature is not a redaction
Signing a document after redacting it is sensible, because it makes later tampering detectable. It does nothing to confirm the redaction worked.
The two are independent, and the checks are different: a signature is verified from the certificate, and a redaction is verified by extracting the text and searching it.
Frequently asked questions
What does a digital signature on a PDF prove?
That the document has not changed since signing and that a particular certificate was used. It does not prove the named person signed it unless the certificate issuance verified their identity.
How do I check a PDF signature?
Preview shows signature status, and Adobe Reader gives more detail including the certificate chain. Look at whether the document was modified after signing and who issued the certificate, rather than only at the status indicator.
Can a signed PDF have been modified?
Yes. A document modified after signing usually gains an incremental update, so the signature covers an earlier revision. Good viewers report this as signed then modified, and more than one %%EOF marker confirms multiple revisions exist.
Does signing a PDF make it safe to send?
No. A signed document carries metadata, attachments and hidden content like any other. Signing makes tampering detectable and says nothing about whether the content was properly sanitised or redacted.
Doing it in Basalt
Basalt is a native macOS PDF toolkit: eighteen tools in one window covering merge, split, page organisation, compression, OCR, passwords, Bates numbering, forms, signing, watermarks and comparison. Every file is processed on your Mac, and the engine that opens documents holds no network entitlement at all, which macOS enforces at the code-signature level. Redaction destroys content rather than covering it, and an independent verifier proves the material is gone before a file is written. A one time $29 licence covers up to three Macs, free for the first 24 hours. basaltformac.com, or brew install --cask chipmunk1101/tap/basalt.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.