How to verify a signed document

Verifying a signed document means confirming that it was actually signed through the platform it claims to be from, by the people it claims, and that it hasn't been altered since. On most platforms, this works through the unique link or identifier tied to that specific signature request — not by re-uploading the file to be scanned.

Why verification works by link or ID, not file upload

A verification page that worked by letting anyone upload a file and checking it against a database of hashes would need to store and compare file hashes for every document ever signed, and still couldn't easily tell you anything beyond "this exact file's hash matches something we have on record." Verifying through the unique link or request identifier tied to that specific signing request is more direct: it looks up the actual record of that signature request — who signed, when, and what the document's hash was — rather than trying to reverse-engineer which record a random uploaded file might correspond to.

What a verification page typically shows

Confirmation the document was signed through the platform, and that the request is complete.
Each signer's identity as recorded during signing (name and email).
The timestamp of signing, and sometimes a timestamp conforming to RFC 3161 for independent time certification.
Whether the document's current hash matches the hash recorded at the time of signing, which is what actually confirms the file hasn't been altered.

Step by step

Find the verification link or request ID — this is typically included on the completion certificate generated when the document finished signing, or in the confirmation email.
Open the verification page using that link or ID.
Review what's shown: the signers, the completion date, and the integrity check result.

What if someone sends you a signed PDF directly, without a verification link?

If you only have the PDF file itself, without the original verification link or request ID, check the completion certificate that should be attached to or delivered alongside the final signed document — it typically includes the information needed to confirm the signature's authenticity, or at minimum the reference details for whoever sent it to confirm independently.

Why the document hash matters here

The document hash is what actually proves integrity, not just the presence of a signature image. If even a single character of the signed PDF changes after signing, its hash changes too, and it will no longer match the hash recorded at signing time — that mismatch is what a verification check is designed to catch.

This doesn't require creating an account

Verifying a document is generally available to anyone with the link or ID, without needing to log in — the point is to let any relevant party (a counterparty, a court, an auditor) confirm authenticity independently, not just the people who were directly involved in signing.

Verifying a document you received from a third party

It's common to need to verify a document that wasn't sent to you directly — a contractor hands you a signed agreement that was originally completed between two other parties, for example. In that case, ask whoever provided the document for the verification link or request ID rather than assuming the PDF alone is sufficient proof. A legitimate signed document should come with that reference readily available; if someone can't produce it, that's worth treating as a yellow flag rather than assuming the document is fine as-is.

What verification doesn't tell you

Verification confirms that a document was signed through the platform and that its content matches what was recorded at signing time. It doesn't independently confirm the signer's real-world identity beyond however they were authenticated to access the signing link in the first place — typically, control over a specific email address. For documents where a stronger identity guarantee matters, that's a separate consideration from document integrity itself, and usually points toward needing a higher signature tier with its own certificate-based identity verification rather than relying on link-based verification alone.

Comparing verification methods

Method	What it confirms	Limitation
Link or ID lookup	Signature completion, signer record, document integrity (hash match)	Requires having the original link or ID
Completion certificate	Same information, in a portable, self-contained document	Only as trustworthy as the certificate wasn't altered itself
Re-checking the document hash manually	Whether a specific file matches what was recorded	Requires separately obtaining the original recorded hash to compare against

Why this matters even for routine documents

It's tempting to think of verification as something you'd only need for a document that's actively being disputed, but checking a document's integrity costs nothing and takes a moment — for anything with real consequences (a signed contract governing a meaningful business relationship, for instance), confirming it hasn't been altered before relying on it is a reasonable habit rather than an overreaction.

Verification vs trusting the sender

In everyday business, most people simply trust the person who sent them a signed document without ever checking the verification link — and most of the time, that's a reasonable call, since outright fraud is uncommon. The value of verification is less about assuming bad faith and more about having an independent, objective check available precisely in the cases where trust alone isn't enough: a higher-value contract, a document that's been passed through several hands before reaching you, or any situation where you'd want to be able to point to something more concrete than "they told me it was fine."

Build verification into your own workflow

If you need to verify signed documents programmatically as part of your own system, Esignapi's API exposes the same signature and audit trail data that the verification page uses, so you can check document status and integrity without a manual lookup each time.

Frequently asked questions

Can I verify a document if I've lost the original link?

Check the completion certificate first, since it typically includes the reference needed to verify. If that's also unavailable, the sender of the original request should be able to retrieve the verification details from their own account.

Does verification require the exact original PDF file?

No — verification works by looking up the record tied to the signature request itself, and comparing the document's hash, rather than requiring you to have and upload the exact original file.

What does it mean if the hash doesn't match?

It means the document's content has changed since it was signed, which indicates the file you have isn't the same as the one that was actually signed — treat it with caution and go back to the original source.

Is verification the same thing as the audit trail?

They're related — verification typically surfaces a summary of key facts from the audit trail (who signed, when, integrity status), while the full audit trail contains the more detailed event-by-event record. See What an e-signature audit trail contains for the full picture.

Can anyone verify a document, or only the people who signed it?

Generally, anyone with the verification link or ID can check it — this is intentional, so a third party (like a business partner reviewing a contract they received secondhand) can confirm authenticity independently.