How to Verify a PDF Has Not Been Modified

PDFs are easy to share, but hard to trust once they move across inboxes, portals, and storage systems. A PDF can be compressed, exported, annotated, replaced, or rebuilt in ways that are hard to notice visually.

WaveSign verifies PDFs by treating the visible pages as the thing that must be protected. The PDF is rasterized, signed at the pixel level, rebuilt as an image-PDF, then verified later against the signed output.

The WaveSign PDF verification package

Verification requires:

1. the signed PDF
2. the matching sig.json
3. the same secret key used during signing

The sig.json file is mandatory. It cannot be regenerated from the signed PDF alone in the current WaveSign flow.

Why WaveSign rasterizes PDFs

PDF files can contain text layers, fonts, annotations, forms, embedded objects, and renderer-dependent layout details. Preserving all of that structure while also making verification stable is difficult.

WaveSign takes a practical route:

1. rasterize original PDF pages at signing time
2. embed the invisible signal into each page image
3. rebuild the signed pages into an image-PDF
4. rasterize the signed PDF again
5. sign the final rasterized pixels used for verification

That final rasterization step is intentional. It reduces verification drift caused by PDF rendering or packaging differences.

The tradeoff: signed PDFs become image-PDFs

This is the most important PDF caveat.

After WaveSign signs a PDF, the output should be treated as an image-PDF. Text selectability, searchable text, form fields, annotations, and original PDF object structure may be lost.

For evidence, scans, visual forms, and final proof packets, that tradeoff can be acceptable. For editable contracts, fillable forms, or documents where selectable text must be preserved, it needs to be planned for.

How to verify a signed PDF

Use the signed file, not the original PDF.

1. Open the WaveSign verification flow.
2. Upload the signed PDF.
3. Upload the matching sig.json.
4. Enter the same key used at signing.
5. Review the verification result.

If the PDF was changed after signing, if the wrong metadata is used, or if the wrong key is entered, verification should fail.

When this works best

WaveSign PDF verification is strongest for workflows where the final visual appearance is the record:

• scanned forms
• inspection reports
• evidence packets
• image-heavy PDFs
• certificates that do not require live text
• final PDF exports sent for review or archive

It is less suitable when the recipient must edit the document, fill fields, or search text inside the signed output.

Bottom line

WaveSign can help verify that a signed PDF still matches the signed visual output. Keep the signed PDF, keep the sig.json, and keep the same key available for future verification.