eIDAS Signature Validator
Validate a PAdES, CAdES, or JAdES signature: integrity, signing time, a level-T timestamp, the certificate chain, and qualification against the EU trusted lists. Clean-room .NET.
Free and informational, and not a qualified validation service under eIDAS. Each mode below states what happens to your input.
Drag a signed PDF, CAdES, or JAdES file here, or
The file is sent to the Tessio verifier service, processed in memory, and not stored.
What this checks
- Detects the AdES format from the file (PAdES, CAdES, JAdES, and recognizes XAdES/ASiC).
- For PAdES, reads each
/ByteRangeand validates the embedded CMS over the signed bytes. - Verifies the signature integrity with the embedded signer certificate.
- Reads the signing time and validates a level-T RFC 3161 signature timestamp when present.
- Builds the certificate chain and reports whether it reaches a publicly-trusted root.
- Checks qualification: whether the signer chains to a granted qualified CA on an EU national trusted list (from the LOTL, refreshed daily).
Frequently asked
What is an eIDAS AdES signature?
AdES (Advanced Electronic Signature) is the eIDAS family of signature formats: PAdES (PDF), CAdES (CMS/PKCS#7), XAdES (XML), JAdES (JSON/JWS), and ASiC containers. Each has baseline levels B, T, LT, and LTA that add a timestamp and long-term validation material.
Which formats does this validate today?
PAdES (signed PDFs), CAdES (attached PKCS#7/CMS), and JAdES (JWS, JSON or compact). It checks signature integrity, the signing time, a level-T timestamp where present, the certificate chain, and EU trusted-list qualification. XAdES and ASiC are recognized and reported, with validation on the roadmap.
Does it tell me if the signature is qualified?
It gives the qualified-issuer signal: whether the signer chains to a granted qualified CA on an EU national trusted list, loaded from the LOTL and refreshed daily. That is not the full TS 119 615 status determination (it does not check the QSCD or QC-statements needed to assert a QES), and the trusted lists' own signatures are not yet cryptographically verified. So it answers "is this from a qualified provider?", not yet "is this a QES?".
Does my document leave the browser?
Yes. Signatures are binary (PDF and CMS), so validation runs on the Tessio verifier service. The file you upload is processed in memory and not stored.