A signed PDF is only evidence if you can show it has not been changed since it was signed. For documents completed by AiresDocs that check takes under a minute and needs no account: compare the file's SHA-256 hash with the one recorded at completion. This guide explains what a hash is, three ways to verify a signed PDF (the public verification page, computing the hash yourself, and the certificate panel for PKI-signed PDFs), what a mismatch does and does not mean, and the habits that keep files verifiable for years.
Why verify
PDFs are easy to edit. A clause can be altered, a page swapped or a date changed with free software, and the signature images stay exactly where they were. If a dispute arises, each side will produce "the signed contract", and the question becomes which file is the real one. Verification answers that mechanically, without arguing about who is more trustworthy.
It also matters outside disputes: a landlord handing a tenancy to a new managing agent, an accountant receiving a signed engagement letter from a client, a buyer checking a supplier's terms. Thirty seconds of verification turns "this looks right" into "this is the file that was signed".
What a hash is
A cryptographic hash function takes any file and produces a fixed-length fingerprint, for SHA-256 a string of 64 hexadecimal characters. The same file always gives the same hash; a file that differs by even one bit gives a completely different hash; and it is computationally infeasible to craft a different file with the same hash. SHA-256 is specified by the US National Institute of Standards and Technology in FIPS 180-4 and is used throughout banking, software distribution and digital signatures.
When a AiresDocs document completes, the final PDF (fields flattened, certificate appended) is hashed and the result is stored in the document record, printed on the certificate page, and sent to every party. Verifying means hashing your copy and comparing. The original upload was hashed too, so you can also check what the signers were shown.
Method 1: the verification page
- Open the AiresDocs verification page. No login.
- Upload the PDF you want to check, or type the document ID printed on its certificate page.
- Read the result. For an upload: the page computes SHA-256 of the file and compares it with the recorded final hash of the matching document. "Match" means the file is byte-for-byte the completed document. For a document ID: the page shows the recorded hashes and completion time so you can compare them with your copy's certificate.
The file is hashed to run the comparison and is not retained. Rate limits apply to prevent abuse, so bulk checking should be done with method 2.
Method 2: compute the hash yourself
You do not have to trust our page. Every operating system can compute SHA-256:
| System | Command |
|---|---|
| Windows (PowerShell) | Get-FileHash .\contract-signed.pdf -Algorithm SHA256 |
| Windows (Command Prompt) | certutil -hashfile contract-signed.pdf SHA256 |
| macOS (Terminal) | shasum -a 256 contract-signed.pdf |
| Linux | sha256sum contract-signed.pdf |
Compare the output with the Final SHA-256 on the certificate page (or in the completion email, or in your exported audit JSON). Case does not matter; every character does. Because the certificate page is part of the final file, the hash printed on it is the hash of the file that contains it, which is possible because the hash is computed after the page is added and recorded alongside the file rather than inside it: the printed value is a label for the file's recorded hash, and the authoritative record is in the document record and the completion email.
Method 3: certificate-signed PDFs
Some PDFs carry a certificate-based (PKI) signature instead of, or as well as, an audit-trail seal. Acrobat Reader shows these in a signature panel with a status: valid, unknown (certificate not trusted on this machine) or invalid (document modified after signing). That check is self-contained in the file and does not need a verification page; it depends on your viewer trusting the certificate issuer. AiresDocs documents do not carry a PKI signature, so the panel will be empty for them; use methods 1 or 2. Our guide on electronic vs digital signatures explains the difference.
When the hash does not match
A mismatch means the bytes differ from the recorded file. It does not by itself mean fraud. Common innocent causes:
- The file was re-saved by a PDF viewer (adding a comment, filling a field, rotating a page, "optimising").
- It was printed to PDF, or passed through an email system that recompressed attachments.
- It was combined with other documents or had pages extracted.
- It is the original upload, not the completed file: compare with the Original SHA-256 instead.
- It is a different document with the same name.
What to do: find a copy that matches. The completion email attachment (or download link), the sender's dashboard download, and the sender's ZIP export all contain the sealed file. If no copy matches and the document record shows a different hash, the file in front of you is not the signed document, and the audit trail becomes your evidence of what was. Read audit trails explained for working through a dispute.
Checking the original, too
The certificate records two hashes. The original is the PDF as uploaded, before fields. If a party claims the document shown to signers contained (or lacked) a clause, hash the sender's source PDF and compare with the original hash: a match proves that exact file was what everyone was invited to sign. This is particularly useful where the sender keeps templates: the template PDF's hash should match the original hash on every document created from it, which proves no one edited the template between sends.
Habits that keep files verifiable
- Keep the sealed file as received. Save the completion attachment somewhere it will not be re-saved. Work from copies.
- Record the document ID and final hash in your contract register next to the file name. It makes verification possible even if the file is renamed.
- Export periodically. The ZIP export contains the PDFs and the audit JSON with both hashes, in a form you control.
- Hand over the hash with the file. When you pass a signed document to a solicitor, auditor or buyer, include the document ID so they can verify independently.
- Prefer the sealed PDF to screenshots or scans when sharing. A screenshot cannot be verified.
How AiresDocs builds the seal is on the security page; the certificate's contents are on the features page.
Frequently asked questions
Do I need a AiresDocs account to verify a document?
No. The verification page is public. Upload the PDF or enter the document ID from the certificate and the result is shown immediately. Nothing about the file is stored by the verification check.
Can I verify a document years later?
Yes. The hash recorded at completion is kept with the document record, and the hash on the certificate page is inside the file itself. Even if AiresDocs were unavailable, anyone can compute the SHA-256 of the file and compare it with the certificate; the method does not depend on us.
Does opening or printing the PDF change the hash?
Opening, reading and printing do not. Saving does, if the application rewrites the file; many PDF viewers do when you add a comment, fill a form or rotate a page. Keep the received file untouched and work from copies.
What if two copies have different hashes but look identical?
At least one has been changed since completion, possibly invisibly (metadata, an annotation, a re-save). The copy whose hash matches the recorded one is the authentic file. Treat the other as a derived copy, not as the signed document.
Sources
This guide explains how things work in general terms and is not legal advice. Spotted something out of date? Email support@airesdocs.com and we will check it against the source.
Put it into practice
Prepare the agreement, send it, and have it signed today. Free for three contracts a month, with the sealed file, certificate and audit trail on every plan.