How to verify a signed PDF

Open the verify page

Every sealed PDF has a document ID, such as ENV-7Q3K2M, printed on its last page and on the certificate of completion. There are two ways in:

• With the document ID only: enter it at mohar.ink/#verify. You see the status, dates, document hashes, recipient roles, audit trail and seal, but no names, title or file names.
• With the full link: the link in the completion email, on the certificate and in the sealed PDF ends with a verification key. It shows the same record with names, the title and the file names. You can also type the key on the page.

The verify page shows finished envelopes only: completed, declined, voided or expired.

What the verify page shows

• Envelope facts: the ID, the status, and when it was sent and completed.
• Documents: for each document, the Original SHA-256 (the file as stored at upload, before anyone signed) and the Sealed SHA-256 (the completed PDF).
• Recipients: each person’s role and when they finished.
• Audit trail: every event in order, with its hash. Chain verified means each event hashes into the next and the chain ends at the stored head, so no event was changed or removed.
• Seal: the certificate the PDF was sealed with, its SHA-256 fingerprint, its validity dates and the signature level.

Compare the file’s hash

A SHA-256 hash is a fingerprint of a file: change one byte and the hash changes completely. Compute the hash of the PDF you have and compare it with the Sealed SHA-256 on the verify page. If they match, your file is exactly the one mohar.ink sealed.

• Windows (PowerShell): Get-FileHash completed.pdf
• macOS: shasum -a 256 completed.pdf
• Linux: sha256sum completed.pdf

Check the seal in your PDF reader

Open the PDF in Adobe Acrobat or Acrobat Reader and open the Signature panel. The seal shows its validity as unknown, because mohar.ink signs with its own certificate rather than one from a certificate authority that the reader trusts. That is expected.

Open the certificate details and compare the SHA-256 fingerprint with the one on the verify page, or with the fingerprint that mohar.ink/api/v1/seal publishes for the current certificate. If they match and the reader says the document has not been modified since the seal was applied, the PDF is as sealed.

Check it on the command line

pdfsig, part of the free Poppler tools, prints each signature in a PDF: pdfsig completed.pdf. For a mohar.ink seal it reports “Signature is Valid” and “Total document signed”, and “Certificate issuer is unknown”, for the same reason as in your PDF reader.

If something does not match

If the hash differs, you have a different file: perhaps an earlier copy, or one changed after sealing. Ask the sender for the copy from the completion email.

If the verify page says Chain broken, or the seal check fails, contact the sender, and write to us at [email protected].