Verify a signed document

Every document completed with Psygned is fingerprinted the moment it is produced: the signed PDF, its Certificate of Completion, and the 2 together in 1 file. Drop any copy of those files here and it is compared with that record. The fingerprint (a SHA-256 hash) is computed in your browser; the file itself never leaves your device, and the answer carries no names or email addresses.

How this works

When the last party signs, Psygned writes the signatures into the PDF, computes its SHA-256 fingerprint, builds the Certificate of Completion, fingerprints that too, and stores both fingerprints with the document's record. The signed document's fingerprint is printed on the certificate, and the completion email carries the fingerprints of the signed document and the certificate, so every party holds them independently of Psygned. A fingerprint changes completely if a single byte of the file changes, so a copy that matches is byte for byte the file Psygned produced.

This page sends only the 64 character fingerprint to Psygned and gets back whether a completed document matches, which of the 3 files it is, the document id (already printed on every page of the signed file) and the completion time. No names, no email addresses, no file contents. You can do the same check without this page: compute the SHA-256 of the file with any hash tool and compare it with the fingerprint on the certificate or in the email.

A file that does not match is not necessarily forged. Opening a PDF and saving it again, printing it to PDF, adding a comment, or combining it with another file on your own computer all produce a different file with a different fingerprint. The signed document and the certificate as Psygned emailed them, and the combined file as downloaded from Psygned, are the copies that match.