How this works: this page reads the Windows PE header of your file, locates the appended Authenticode signature (a PKCS#7 block containing the signer's certificate and a declared file hash), and independently recomputes that hash from the file's current bytes using the same exclusion rules Windows itself uses. If the two hashes match, the file hasn't changed since it was signed. All of this happens in your browser tab; nothing you drop here is ever sent anywhere.
What this tool deliberately does NOT do:
- It does not validate the certificate chain against Windows' trusted roots — it just shows you who the signature claims to be from. A perfectly "valid-looking" signature can still be from a certificate nobody trusts (including a self-signed one).
- It does not check certificate revocation (CRL/OCSP). A revoked certificate will still show up here as a normal-looking signer.
- It does not verify the cryptographic signature itself (that the signature bytes were really produced by the signer's private key) — only that the declared file hash matches the file's current bytes.
For a real trust decision, use Windows' own signtool verify or right-click → Properties → Digital Signatures on the file itself.
Troubleshooting
It says "not signed" but Windows shows a signature
Double check you dropped the actual signed file and not a copy made after signing (some build/packaging/antivirus tools rewrite files in ways that strip the signature). If Windows Explorer's Digital Signatures tab shows nothing either, the file genuinely isn't signed.
"Recomputed hash does not match" — does that mean malware?
It means the file's bytes are different from what was signed — not necessarily malicious. This is exactly what a corrupted download, a disk error, or a genuinely tampered file all look like. Re-download the file from its original source and check again before drawing conclusions.
Why does it say "no timestamp"?
Without an embedded RFC3161 (or legacy) timestamp, Windows treats the signature as invalid once the signer's certificate expires — even if the file hasn't changed. A timestamp lets the signature keep being treated as valid for that point in time, indefinitely.