Verify Documents
Verify the authenticity of reports and quotes from turingpoint GmbH, or any other signed PDF. The check runs entirely in your browser; the document is not uploaded.
Check PDF Signature
Check a Signed PDF
Drop a PDF into the box. You immediately see who signed it, whether the document has changed since, and how the signature rates under eIDAS.
What Is Checked
How the Check Works
- Document Unchanged
A signature covers a precisely defined byte range of the file. We recompute its checksum and compare it with the signed one. A single changed character shows up.
- Changes After Signing
PDFs can be extended after signing. Many viewers then show the new content with a “valid” seal. We point this out and let you download the version that was actually signed.
- Trusted Origin
The certificate is traced back to a known certificate authority: the roots with email trust from the Mozilla program and all trust services in the EU Trusted Lists.
- Timestamp and Revocation
A timestamp proves when the document was signed. Embedded OCSP responses and revocation lists show whether the certificate was revoked at that time.
Frequently Asked Questions
Questions About the Signature Check
We sign our reports and quotes with the S/MIME certificates of our managing partners (D-Trust). You find the certificates and their fingerprints on About us.
- Is my PDF uploaded?
No. The check runs entirely in your browser (JavaScript and WebCrypto). The document never leaves your device. Only the public trust lists are fetched.
- How do I recognize a genuine document from turingpoint?
For our certificates, the check additionally shows the label “turingpoint GmbH” with the signer's name. If in doubt, compare the SHA-256 fingerprint with the details on our About us page.
- How do I recognize a qualified electronic signature (QES)?
A QES requires a qualified certificate, a key on a qualified signature creation device and a qualified trust service provider from the EU Trusted List. If all three apply, the check shows “Qualified electronic signature (QES)”.
- Why does it say “revocation not checked”?
For technical reasons (CORS), a browser usually cannot query the OCSP and CRL servers of certificate authorities directly. The check therefore uses revocation data embedded at signing time (PAdES B-LT).
- What does “Limited” mean?
The signature is mathematically fine, but something limits the statement: for example a certificate without a chain to a known authority (company-internal PKI, self-signed), a certificate that has expired by now without a timestamp, or changes after signing.
- Is the result legally binding?
No. The check gives a technical assessment. Legally binding validation reports under eIDAS are the job of qualified validation services.
Contact