What "verifying a PDF" actually means
When someone asks whether a PDF is genuine, they are usually asking one or more of four
separate questions:
Integrity — is this file byte-for-byte the same as the one that was
issued, or has it been altered? Origin — which organisation issued it?
Time — when did the file exist in its current form?
Status — is this still the current version, or has it been superseded
or withdrawn?
These are different checks with different methods. A document can pass one and fail
another: a file can be unaltered but superseded, or current but impossible to attribute
to an issuer. A useful verification process answers all four.
Checking integrity with a file hash
A cryptographic hash (commonly SHA-256) is a fixed-length fingerprint computed from a
file's exact bytes. If even one byte of the PDF changes, the hash changes. To check
integrity, compute the hash of the file you received and compare it with the hash
recorded when the document was issued.
On macOS or Linux, shasum -a 256 document.pdf prints the SHA-256 hash. On
Windows, certutil -hashfile document.pdf SHA256 does the same. The
practical difficulty is not computing the hash — it is having a trustworthy record of
what the hash was at issue time. Without a recorded reference value, a hash on its own
proves nothing.
Checking time with a trusted timestamp
A timestamp from a time-stamping authority under RFC 3161 provides evidence that a
specific hash existed by a specific time. The authority signs the hash together with the
time, so the resulting token can be checked later. A trusted timestamp does not say who
created the file or whether its contents are accurate — it establishes that the file, in
its current form, existed by the recorded time.
Checking origin and status
Origin is the hardest attribute to check manually. A signature image or letterhead can
be copied into any document, and an email sender address is not reliable evidence of
issuance. Meaningful origin checks depend on recorded issuer attributes — organisation
identity information captured and verified before the document was issued — that a
recipient can review alongside the file.
Status matters because documents get revised. An engineering report, a certificate, or a
drawing may be superseded weeks or years after issue. A static PDF cannot tell you this;
only a live record of the document's current status can — including whether it has been
revoked or replaced by a newer revision.
Where a verification record fits
A recipient-accessible verification record combines the four checks in one place: the
recorded issuer attributes, the submitted file's hash, an RFC 3161 timestamp, and the
document's current platform status. A recipient compares the file they hold against the
record — typically via a QR-linked page — without creating an account or contacting the
issuer's office.
Verified.Tools is testing exactly this workflow with Australian and New Zealand
engineering firms in a private beta. The record shows what was recorded at issue: the
hash changes if the file changes, the timestamp evidences when the submitted hash
existed, and the page shows the current certification status.
What verification cannot prove
No hash, timestamp, or verification record proves that the original document's contents
were substantively correct, that the author was competent, or that the document meets a
particular legal requirement in a particular transaction. Verification establishes what
file was recorded, by whom, when, and its current status — nothing more. Treat any
product that claims otherwise with caution, and obtain professional advice for
transaction-specific requirements.
Related reading
What should a recipient be able to verify about an issued engineering PDF?
Emailed PDFs are no longer enough for important issued documents