How to check a signed PDF hasn't been changed
Work out the SHA-256 fingerprint of your copy and compare it with the "Signed document" fingerprint on the completion certificate. If the two match, your copy is byte for byte the document that was signed.
Where the fingerprints are
The completion certificate that came with the signed PDF has a section called "Checking your copy is the one that was signed". It gives two fingerprints: the original, as uploaded, and the signed document. Each is 64 characters of numbers and the letters a to f. See a sample certificate (PDF).
Work out your copy's fingerprint
On a Mac. Open Terminal, type shasum -a 256 with a space at the end, drag the signed PDF into the window, and press Return.
On Windows. Open Command Prompt, type certutil -hashfile with a space at the end, drag the signed PDF into the window, type SHA256, and press Enter.
On Linux. Run sha256sum or shasum -a 256 followed by the file's name.
Each prints a line of 64 characters. That is your copy's fingerprint.
Compare them
Compare it with the "Signed document" fingerprint on the certificate, every character. Capitals don't matter; anything else does.
- They match. Your file is exactly the one Paraph produced when the last person signed.
- They don't match. The file has changed since it was signed. That can be innocent: opening a PDF and saving it again in some viewers rewrites the file. Use the copy attached to the completion email, or ask the sender to download it again from Paraph, and check that one.
What this does and doesn't show
A matching fingerprint shows the file hasn't changed. It doesn't show who signed it: for that, the certificate's list of signatories and the audit trail are the evidence, with the limits in What an audit trail proves, and what it doesn't.
The PDF doesn't carry a cryptographic seal, so a PDF reader won't show a signature panel for it. The fingerprint is the check. The security page explains why there's no seal yet.