Verify a Signed PDF
Check that a document signed with Toololo Sign is exactly the file that was signed.
or drop it here. The file stays on your device — only its fingerprint is checked.
How the check works
Every time someone signs a document through a Toololo signature request, our server records the SHA-256 fingerprint of the file they sent back, together with when each person signed. A fingerprint is a 64-character code calculated from every byte of the PDF.
When you choose a PDF here, your browser calculates its fingerprint and asks our server whether that fingerprint was recorded. The PDF itself is never uploaded. Change one character, one pixel or one byte of metadata and the fingerprint is completely different, so a match means the file is unchanged.
If there is no match
- the file was changed after it was signed — even re-saving it in another program changes it;
- it was not signed through a Toololo signature request (a PDF you signed and downloaded on your own is not recorded);
- or the record is older than three years, when it is deleted.
What a match proves, and what it doesn't
A match proves the file is byte-for-byte the one recorded, how many people signed, whether each confirmed a code sent to their email, and when the last signature was made. It is a simple electronic signature under eIDAS Article 25(1). It does not prove who a person is with a bank ID or passport, and it is not a qualified electronic signature.
This check shows no names, email addresses or IP addresses, so a copy that ends up with a stranger reveals nothing beyond what is printed in the file. For the check we keep only the fingerprint, the number of signers and the signing time. The full audit record, including IP addresses, is kept privately for 3 years and can be opened only by the people in the request, through their own signing links. The document itself is deleted 48 hours after the last signature.