How to verify that a signed document is genuine

What "genuine" means for a signed document

A signed document is genuine when three things hold:

1. Who: the people named as signers are the people who signed.
2. What: the document you hold is exactly the one they signed, with nothing added, removed or changed since.
3. When: it was signed at the time it says.

The law asks similar questions. In the United States, the Uniform Electronic Transactions Act (UETA) says an electronic signature is attributable to a person "if it was the act of the person", which "may be shown in any manner, including a showing of the efficacy of any security procedure" (section 9(a)). In federal courts, whoever relies on a document "must produce evidence sufficient to support a finding that the item is what the proponent claims it is" (Federal Rule of Evidence 901(a)). A picture of a signature answers none of the three questions on its own, because an image can be pasted onto any page.

This page is general information, not legal advice.

How most e-signature services let you check

Most e-signature services give you two things to check a signed document with, as they describe them on their own pages (read October 11, 2026):

• A certificate of completion or audit trail. DocuSign says "Every signed Docusign eSignature document comes with a certificate of completion that provides proof of the signing process to all parties of the transaction." It is the service's record of its own process.
• A digital seal on the PDF. The service signs the finished PDF with its own certificate, and a PDF reader's signature panel checks it. DocuSign describes its PKI seal this way: "This tamper seal indicates the electronic signature is valid and that the document has not been tampered with after it was downloaded from DocuSign eSignature." Adobe Acrobat Sign certifies final PDFs so that Adobe Acrobat and Acrobat Reader show a blue banner.

In both cases the record and the cryptographic seal come from the vendor. The seal is the platform's, not each signer's; Documenso's documentation puts it plainly: "The signature is applied at the platform level, not by individual signers." Some services also keep part of the proof on their side. Dropbox Sign's legal page says: "If you ever need to prove there was no tampering… Dropbox Sign can provide you with the two unique document records."

How Attest makes the check independent

Attest is built so that nobody has to take a vendor's word for it, Attest's included.

• Each signer signs with their own key. Every signer approves with a passkey: a cryptographic key only the signer controls, which they use with Face ID, Touch ID, Windows Hello or the device PIN. The passkey signs an exact statement that names the document's SHA-256 fingerprint and the fingerprint of everything that signer entered, together with the agreement ID, the signer's name and the time. The statement carries the signer's name and, in place of their email address, a salted commitment to it (a fingerprint of the address and a secret value Attest gives only to the parties), and the passkey also signs where their entries sit on the page and a commitment to their own encryption key. Anyone can re-check each signature with any standard WebAuthn library.
• The finished agreement is anchored on a public blockchain. A blockchain is a public ledger that anyone can read. When the last signer signs, a fingerprint of the signed state (the document's fingerprint and, for each signer, who signed, when, and the fingerprint of their entries) is written to Horizen, a public blockchain. Only fingerprints go on chain: no document content, title or email.
• Every party gets a copy that proves itself. The sealed PDF holds the signed pages, with a "Signed with Attest" stamp on each signature and a seal line at the foot of every page, a certificate of completion, the audit trail up to completion and a "Verify it yourself, without us" page. Attached inside it are the original document exactly as signed, the full evidence and a standalone verifier.
• Anyone can verify, free. Checking a document needs no account and costs nothing.

Ways to check an Attest document

What you have	What to do	What you learn
The signed PDF	Drop it on the verifier attached to it, or on the current version at attest.datahubz.com/attest-verifier.html	Each signer's passkey signature and entries, the original document, the pages you see and Attest's anchored record on Horizen, checked on your device
The signed PDF	Drop it on attest.datahubz.com/verify	Whether it is the exact file that was recorded and anchored
A verification code (ATT-XXXX-XXXX)	Type it at /verify, or scan a stamp's QR code	The agreement's certificate: who signed, when, and its anchor
An agreement ID (agr_...)	Paste it at /verify	The same certificate
A 64-character fingerprint	Paste it at /verify	The record it matches, such as a signed copy or a public agreement
A proof ID (azk_...) or proof link	Paste it at /verify	The one fact the proof states, and whether it is valid

Step by step: check an Attest document online

1. Open attest.datahubz.com/verify, or verify.datahubz.com, which shows only the verifier.
2. Type the verification code (ATT-XXXX-XXXX) from a signature stamp or from the foot of any page, or the agreement ID (agr_...), and select Verify. Scanning the QR code on a stamp opens the same record.
3. Read the agreement's certificate. It re-checks every passkey signature and reads the anchor from the blockchain in your own browser, each time it loads. It shows the title, the file name, the verification code, the fingerprints of the document, the signed copy and the signed state, each signer's name and signing time, the blockchain anchor and each signature's evidence. It never shows the document, and it shows signers' email addresses only to the parties.
4. Check the file you hold: drop the signed PDF on the page. Your browser computes its fingerprint and the file itself is never uploaded. A sealed signed copy is found by its fingerprint, and so is the original document of an agreement whose certificate is public. A changed file won't match.
5. If you were given a printed copy, remember that a stamp leads you to the record but a printed page can't prove its own words. To check a paper, compare it with the signed copy.

If the agreement's certificate is private, a lookup tells you the agreement exists and is private. Ask one of the parties for a zero-knowledge proof instead: a cryptographic proof that confirms a single fact, such as that they signed the agreement and the date it was completed, and reveals nothing else.

Step by step: check it with no Attest service at all

1. Get the verifier. It is attached to every signed copy as attest-verifier.html, and anyone can download it from the verify page. The current version is also published at attest.datahubz.com/attest-verifier.html. Its source code and every release, with the release's SHA-256, are public on GitHub (DataHubz/attest-verifier) under the MIT license.
2. Open it in any browser.
3. Drop the signed PDF on it. It checks the original document inside the signed copy against what every signer signed, each signer's passkey signature and entries, Attest's anchored record of the agreement on Horizen, and that nothing was added to the PDF after it was sealed. It also re-makes every page you see from what was signed (the original document, each signer's signed statement and entries, and the completion details Attest anchored) and compares the result with the copy byte for byte, so pages drawn with anything else fail. It pins its trust root (the chain, Attest's registry and the keys it checks against are built into the verifier, never read from the file being checked) and accepts only anchors from Attest's registered wallets. It reads only a public blockchain node, which can be any node of that chain, and apart from that on-chain check, it works offline.
4. Go deeper if you want. Every cryptographic check can be repeated with standard tools: any SHA-256 tool, any WebAuthn library and any Ethereum JSON-RPC node, and re-making the pages uses the open-source renderer published with the verifier. The evidence file lists each check.

This is tested, not theoretical. A real agreement signed on attest.datahubz.com and anchored on Horizen was verified with Attest blocked, by the verifier inside its signed copy, reading only a public blockchain node, and changing its pages made verification fail. The film, "We blocked Attest. The agreement still verified.", is on the signing page.

What a successful check proves

• Who: each signature was made by a passkey only that signer controls, registered to their email address, and the passkey confirmed the signer was present and verified (Face ID, fingerprint or PIN). Attest checked each signature against that passkey's public key before recording it. Attest confirms control of the email address and the passkey, not a government ID.
• What: change one byte of the document, of any signer's entries or of the signed pages, and verification fails. Each is checked by SHA-256 against what was signed and anchored. How to tell if a document was changed after signing explains fingerprints in detail.
• When: each signer's statement carries a signing time set by Attest's server and signed by their passkey, and the Horizen block time shows when the signed state was anchored.

To let a lender, landlord or auditor run these checks themselves, see how to let others check a signed document. The tutorial Verify a signed document, and share proof walks through each step on the real app.