Tamper-evident seal

What does Tamper-evident seal mean?

A tamper-evident seal is a cryptographic mark applied to a signed document, usually a PDF, that makes any later change detectable. Open a sealed PDF in a reader such as Adobe Acrobat and you may see a banner saying the document has not been modified since it was signed, or a warning that it has. That banner is the tamper-evident seal doing its job.

Technically, the process starts with a document hash of the finished file. That hash is then signed using a private key tied to a digital certificate, following PKI standards. When someone opens the file, their software recalculates the hash and checks it against the signed value using the public key. If anything in the covered content has changed, the check fails and the reader flags it.

Say a recruitment firm sends a signed placement agreement to a client. The client's finance team opens it months later to check the fee percentage. If the PDF carries a valid seal, their reader confirms the file is intact. If someone had edited the fee after signing, the seal would show as broken, and the team would know not to trust that copy.

A key misconception is that tamper-evident means tamper-proof. The seal does not stop anyone from editing a file; it just makes the edit visible. Another is that the seal proves who signed. It proves which organisation or certificate applied the seal and that the file is unchanged since, while evidence about individual signers still comes from the audit trail. Seals can also show warnings simply because a reader does not trust the certificate authority, not because of tampering.

Tamper-evident seals rely on the same building blocks as digital signatures and qualified electronic signatures under eIDAS, but a seal applied by a platform is not the same as a qualified signature by the signer. Many platforms apply their own seal to every completed file. Where a document hash is published separately, it can serve a similar purpose even when no seal is embedded, because any change to the file produces a different fingerprint that will not match the recorded value.

Our take: embedded PDF seals are useful, but they are not the only way to prove integrity. A published SHA-256 hash that anyone can check is simpler, easier to understand, and does not depend on which PDF reader someone happens to use.

Today eSignSimple provides integrity checking through a SHA-256 hash of the final file, stored when the last signer finishes and verifiable on our public /verify page. Certificate-based PDF seals that show up inside readers like Acrobat are on our roadmap.

What is an example of tamper-evident seal?

A supplier emails a customer a signed contract carrying a certificate-based seal. When the customer's finance team edits a figure in the PDF and re-saves it, their PDF reader immediately shows the seal as broken. eSignSimple takes a different route to the same goal: it does not embed a cryptographic seal, but it records a SHA-256 hash of the final file that anyone can check on /verify.

Why does my PDF say the signature is invalid when nothing was changed?

The most common reason is trust, not tampering. A reader such as Adobe Acrobat checks two separate things: whether the file still matches what was sealed, and whether the certificate used for the seal chains up to a root the reader trusts. If the certificate was issued by an authority the reader does not know, you see a warning such as validity unknown, even though the document is intact. Adobe maintains its own trust list, and in the EU readers can also use the EU Trusted List.

Other harmless causes include an expired certificate without a trusted timestamp, a reader that cannot reach the revocation service while offline, and changes made after sealing that the seal permits, such as filling a form field. Real tampering shows differently: the reader reports that the document has been altered or corrupted since the signature was applied. Look at the signature panel rather than the banner alone, because the panel tells you which of these situations you are in.

Can a sealed PDF be edited without breaking the seal?

PDFs are saved in layers. A later edit is usually added as an incremental update on top of the sealed version rather than replacing it, which is why a reader can say the signed revision is intact but the file has changed since. A careful reader will offer to show you the signed version. Seals can also be configured to allow specific changes, such as adding further signatures or filling in fields, while flagging anything else.

So the honest answer is that the file can be edited, but a proper validator will notice. What a seal cannot catch is a document that was wrong before sealing: a typo, a missing clause, or a page that was never included. Integrity checks prove the file is what was sealed, not that what was sealed is what everyone meant to agree.

Embedded seal vs published hash: how do they compare?

An embedded seal travels with the file and is checked automatically by compatible readers, but it relies on certificate trust and on the reader the recipient happens to use. A published SHA-256 hash is independent of any reader: you calculate the fingerprint of the file you hold and compare it with the value recorded at completion. If they match, the file is byte-for-byte identical; if a single character changed, they will not match.

With eSignSimple, the hash of the final PDF is printed on the certificate of completion and stored, so you can drag a copy onto our verify page and see whether it matches a completed document. Our guide on how to verify an electronic signature walks through both approaches, including what to do when the hash does not match.

What should you keep so integrity can be proven years later?

Keep the completed file exactly as you received it, without re-saving, printing to PDF or running it through a compressor, because any of those produce a new file with a different hash and may strip an embedded seal. Store the certificate of completion with it. For long-term archives, a second copy in a separate location protects against accidental edits. If you need to annotate the contract, work on a copy and leave the original untouched.

Which terms are related?

• Digital signature: A digital signature is a cryptographic mechanism that uses public key infrastructure to prove who signed a document and that it has not changed.
• Audit trail: An audit trail is a chronological record of events in a document's signing process, such as sending, viewing and signing, with timestamps.
• Document hash: A document hash is a fixed-length fingerprint computed from a file's contents; any change to the file produces a different hash.
• SHA-256: SHA-256 is a cryptographic hash function from the SHA-2 family that turns any file into a unique 256-bit fingerprint used to detect tampering.
• Public key infrastructure (PKI): PKI (public key infrastructure) is the system of certificate authorities, digital certificates and key pairs that binds public keys to real identities.