Verify a signed document

What this check actually proves

When the last person signs a document with eSignSimple, we compute a SHA-256 fingerprint of the finished PDF, including the certificate of completion at the end, and store it next to the audit trail. A fingerprint is a 64-character value that changes completely if even one byte of the file changes. When you drop a PDF on this page, your browser computes the same fingerprint and asks us one question: have we ever issued a completed document with exactly this value?

A match tells you two things at once: the file came out of eSignSimple as a finished, fully signed document, and nobody has edited it since. No match does not automatically mean fraud. It means this exact file is not one we produced. Re-saving a PDF in another app, printing it to PDF, compressing it or adding a comment all create a different file, even when the page looks identical to the eye.

Why we fingerprint instead of asking you to trust a logo

Plenty of signing tools stamp a badge or a watermark on the final page and call it tamper-proof. Our take: a badge is decoration. Anyone with a PDF editor can copy it onto a document that was never signed. A fingerprint cannot be copied onto a different file, because the fingerprint is derived from the file itself. That is why we built verification around the hash and made the check public, free and anonymous.

It also means the check works years later without us having to keep a copy of your document on display. The fingerprint, the signer names and the completion time are enough to answer the question. The document's contents never have to travel back to us.

Your file stays on your device

The fingerprint is calculated in your browser with the standard Web Crypto API. Only the 64-character value is sent to our server, never the PDF. That matters when the document is an employment contract, a lease or anything else you would rather not upload to a website just to check it. You can confirm this yourself: open your browser's developer tools, watch the network tab and you will see a single small request that carries the fingerprint and nothing else.

What to do if a document doesn't match

First, make sure you are checking the original file from the completion email or your eSignSimple dashboard, not a copy that was forwarded, scanned or re-exported. If the original still doesn't match, compare the fingerprint printed in the completion email with the value shown above. If they differ, the file has been changed since signing. Ask the sender for the copy they downloaded from eSignSimple, and if the stakes are high, treat the unmatched version as unverified until you have one that matches.

If you are the sender, your document page in eSignSimple shows both the original and the final fingerprints next to the full audit trail: who opened the document, from which IP address and device, and when each person signed. That record is what you would rely on in a dispute; this page is simply the fastest way for anyone else to check it.