Verify a signed document

What this check actually proves

When the last person signs a document with eSignSimple, we compute a SHA-256 fingerprint of the finished PDF, including the certificate of completion at the end, and store it next to the audit trail. A fingerprint is a 64-character value that changes completely if even one byte of the file changes. When you drop a PDF on this page, your browser computes the same fingerprint and asks us one question: have we ever issued a completed document with exactly this value?

A match tells you two things at once: the file came out of eSignSimple as a finished, fully signed document, and nobody has edited it since. No match does not automatically mean fraud. It means this exact file is not one we produced. Re-saving a PDF in another app, printing it to PDF, compressing it or adding a comment all create a different file, even when the page looks identical to the eye.

Why we fingerprint instead of asking you to trust a logo

Plenty of signing tools stamp a badge or a watermark on the final page and call it tamper-proof. Our take: a badge is decoration. Anyone with a PDF editor can copy it onto a document that was never signed. A fingerprint cannot be copied onto a different file, because the fingerprint is derived from the file itself. That is why we built verification around the hash and made the check public, free and anonymous.

It also means the check works years later without us having to keep a copy of your document on display. The fingerprint, the signer names and the completion time are enough to answer the question. The document's contents never have to travel back to us.

Your file stays on your device

The fingerprint is calculated in your browser with the standard Web Crypto API. Only the 64-character value is sent to our server, never the PDF. That matters when the document is an employment contract, a lease or anything else you would rather not upload to a website just to check it. You can confirm this yourself: open your browser's developer tools, watch the network tab and you will see a single small request that carries the fingerprint and nothing else.

What to do if a document doesn't match

First, make sure you are checking the original file from the completion email or your eSignSimple dashboard, not a copy that was forwarded, scanned or re-exported. If the original still doesn't match, compare the fingerprint printed in the completion email with the value shown above. If they differ, the file has been changed since signing. Ask the sender for the copy they downloaded from eSignSimple, and if the stakes are high, treat the unmatched version as unverified until you have one that matches.

If you are the sender, your document page in eSignSimple shows both the original and the final fingerprints next to the full audit trail: who opened the document, from which IP address and device, and when each person signed. That record is what you would rely on in a dispute; this page is simply the fastest way for anyone else to check it.

What a match does not prove

A match proves integrity and origin: this exact file was completed through eSignSimple and has not changed by a single byte since. It does not prove who was physically holding the phone when a signature was made. Each signer is identified by the email link they used, with the IP address, device and time recorded in the audit trail. Whether that identity evidence is enough for a given purpose is a separate question, answered by the audit trail and the circumstances, not by the fingerprint.

A match also does not mean the contract is fair, enforceable or legally suitable for its subject. A will, a deed or a document that legally needs a notary may still need other formalities, even if every signature on it is real. And it says nothing about documents that were never completed, such as one that was voided or declined. Only completed documents have a final fingerprint to check.

How do you compute a SHA-256 hash yourself?

You do not have to trust our page to compute the fingerprint. Every major operating system can do it with a built-in command. On macOS, open Terminal and run shasum -a 256 followed by the path to the file; dragging the PDF into the Terminal window fills in the path. On Windows, open Command Prompt or PowerShell and run certutil -hashfile followed by the file path and SHA256. On Linux, run sha256sum followed by the file path.

Each command prints a 64-character hexadecimal value. Compare it with the fingerprint in the completion email and with the value this page shows after you choose the file; all three should be identical. Upper or lower case does not matter, and if an older version of Windows prints spaces between pairs of characters, ignore them when comparing. If you would like a deeper look at what the algorithm does, our glossary entry on SHA-256 explains it in plain language.

Which fingerprint is which?

Every completed document has two fingerprints, and mixing them up is the most common source of confusion. The original fingerprint belongs to the document as it was sent for signature, before anyone signed. It is printed on the certificate of completion inside the signed PDF, so signers can see exactly which version they were asked to sign. The final fingerprint belongs to the finished file, signatures and certificate included.

The final fingerprint cannot be printed inside the file it describes, because adding it would change the file and therefore the fingerprint. That is why it lives in the completion email and on the sender's document page, and why this page checks against the final fingerprint. If you compare a downloaded signed PDF with the original fingerprint on its certificate, they will never match, and that is expected.

A step-by-step plan for a mismatch

Step one: find out where your copy came from. Files saved from an email preview, downloaded through a document management system, or opened and saved in a PDF editor are often rewritten silently. Step two: get the original. Signers can use the download link in their completion email; the sender can download it again from their dashboard. Step three: check that copy here or with one of the commands above. In our experience, almost every mismatch ends at step three with a match.

If the original from eSignSimple matches and your other copy does not, the other copy has been altered, even if only by re-saving. Use the original from then on. If you are reviewing a document for a dispute, keep both files, note where each came from, and rely on the matching one together with the audit trail. Our guide on how to verify an electronic signature covers what else to look at, from the certificate to the email history.