Signature is valid but the document was modified: what does it mean?

Two messages that seem to contradict each other: the signature is valid, and the document has been modified since it was signed. How can both be true?

They can, and it happens every day. Understanding why takes two minutes and will make you much better at reading any signature report.

The short answer

A digital signature covers the file as it was at the moment of signing. PDF lets software add new material after that point by appending it to the end of the file, leaving the signed bytes untouched. The signature still checks out (the part it covers really is unchanged) but the file now contains extra material that no signature covers.

So the two messages describe two different parts of the file:

• "Signature valid" is about the signed part.
• "Modified since signing" is about what came after.

Why PDFs work this way

This behaviour is deliberate. Think of a contract that three people must sign:

1. Person A signs. The file now contains version 1 plus A's signature.
2. Person B opens it, signs, and saves. B's software appends B's signature to the end. A's bytes are untouched, so A's signature stays valid.
3. Person C does the same.

If adding B's signature rewrote the file, A's signature would break every time someone else signed. Appending (called an incremental update) is what makes multi-signer documents possible. Filling in a form after signing works the same way.

The price of that design is that anything can be appended, not only signatures. Someone could append a new page, a text box that covers a figure, or a comment. The original signature would still be valid, because the original bytes are still there. That is why a good checker never stops at "valid".

Normal changes vs. changes to worry about

Usually normal

• A later signature was added. Multi-party signing. Each later signature should itself be listed and checked.
• Form fields were filled in after signing: on a document designed to be signed first and completed later.
• An empty signature field was added for the next signer.

Worth questioning

• Page content was changed. New text or images drawn on a page.
• A page was added or removed, or the pages were reordered.
• A text box, stamp or shape was added: these can sit on top of signed text and change what a reader sees.
• A comment or highlight was added. Often innocent, occasionally used to obscure something.
• A signature was replaced or removed.

Certified documents: when the author sets the rules

The first signature on a document can be a special kind called a certification signature. The person certifying decides what may happen afterwards:

• No changes allowed at all;
• Form filling and signing only;
• Form filling, signing and comments.

If a later change falls inside what the certification permits, the signature is still in good standing. If it falls outside (for example, page content changed on a document certified as "no changes") the certification is broken in spirit even though the original bytes are intact.

Adobe marks certified documents with a blue ribbon in the Signature Panel. Some official publishers use certification precisely so readers can see the document is in the state they released it.

How to see what was actually added

Verify PDF Signature separates the two kinds of later change for you:

• Permitted additions: later signatures and form filling that the signature allows. They do not change what was signed. The verdict line then reads "Unchanged since [name] signed it. Only permitted additions were made afterwards."
• Changed after this signature: everything else, listed page by page in plain words: "Page 3: the page content was changed", "Page 1: a text box was added", "Page 5 was added", "The pages were put in a different order."

For anything on a page, Compare the changed pages shows the page as signed next to the page now. And Download the version that was signed hands you the exact file as that person signed it, before any later additions. The version the signature actually vouches for.

If the tool reports that something was added but it found no change to pages, comments or form fields, the addition is structural. For example, a program re-saved the file incrementally and added internal data. That is often harmless, but you cannot rule out that it matters without asking whoever saved it.

What Adobe shows in the same situation

In Acrobat or Reader, the message bar at the top typically reads "Signed and all signatures are valid, but with unsigned changes after the last signature", with a yellow warning triangle rather than a green tick. The Signature Panel shows each signature as valid and notes that the document has been changed since it was signed. Acrobat can also show you the signed version. Look for an option to view the signed version in the signature's menu. The exact wording varies a little between versions; the idea is the same.

What you should do

1. Look at the list of changes. A later signature or form entry: probably fine. A changed page: find out why.
2. Compare the pages. Your eyes are the best judge of whether a change matters.
3. Rely on the signed version for anything important. If there is a dispute, the signed version is what the signer agreed to.
4. Ask the sender about any change you did not expect, and ask for the file exactly as it left the signing software.
5. Keep a report. Download report (PDF) records every signature and every change, with the file's SHA-256 fingerprint.

If you are the one signing documents

• Sign last, after all edits are done. Anything you do after signing becomes an unsigned addition.
• If others will only fill in fields or sign, a certification signature that allows only form filling and signing makes that explicit. See Digital Signature.
• Never "tidy up" a signed file with a tool that rewrites it (compressing, merging, printing to PDF). It will either break the signature or strip it.