PDF LTV Validator Online — Verify Long-Term Digital Signatures & DSS
Validate PDF digital signatures for PAdES Long-Term Validation (LTV) compliance online for free. Inspect DSS dictionaries, OCSP responses, and CRLs locally.
DROP PDF FILES HERE
or click to choose files from your device (.pdf)
How PDF LTV Validation Works
Inspect cryptographic structures, certificate validation stores, and revocation lists in three automated browser steps.
Add Signed PDF Files
Drop signed PDF files into the validation sandbox. Files are parsed completely within your browser memory without uploading bytes to remote servers.
Inspect DSS & Revocation Data
The cryptographic engine verifies /DSS catalogs, checks for embedded OCSP tokens, and validates CRL certificate revocation lists across document revisions.
Review Status & Export Report
Examine visual signature locations, verify signer identities, and export comprehensive JSON or CSV compliance reports for long-term archiving.
Utilvo In-Browser vs Cloud Signature Audit Services
Compare client-side cryptographic parsing against traditional server-based signature validation platforms.
| Evaluation Criteria | Utilvo In-Browser | Cloud Audit Services |
|---|---|---|
| Data Confidentiality & Privacy | 100% In-Browser (zero byte uploads, certificates remain private) | Signed documents and public certificates transmitted to cloud servers |
| Document Security Store Audit | Direct binary /DSS catalog, /Certs, /OCSPs, and /CRLs inspection | Often only verifies online certificates without checking embedded LTV |
| Offline Autonomous Verification | Runs completely offline without external server dependencies | Requires active internet access to reach external validation endpoints |
| Audit Report Export Options | Instant client-side JSON and CSV structured compliance export | Locked behind enterprise subscription paywalls or restricted APIs |
| Execution Speed & Limits | Instant local memory parsing with no file queue or rate throttling | Limited by server bandwidth, per-file size caps, and API credit limits |
How Document Security Store (/DSS), OCSP & CRL Archival Validation Works
How the cryptographic auditor inspects document catalogues, signature dictionaries, and revocation tokens.
Document Security Store (/DSS) Parsing
The validation engine parses the PDF root catalog for the /DSS dictionary defined in ISO 32000-1 and PAdES ETSI EN 319 142. It audits presence of the /Certs array containing the complete X.509 certificate chain from leaf to trust anchor.
OCSP Response Stream Validation
Online Certificate Status Protocol (/OCSPs) streams embedded in the DSS structure are checked for cryptographic validity, ensuring revocation proofs were acquired while the issuing CA certificate was actively valid.
Certificate Revocation List (/CRLs) Audit
Embedded CRL tables are analyzed to confirm authoritative revocation status coverage for all intermediate certificates in the signing path, protecting against post-issuance key compromise.
Visual Annotation & Viewport Mapping
Using standard PDF.js canvas coordinate transforms, the engine extracts visual signature bounding boxes (/Rect) and overlays interactive metadata indicators showing signer identity, signature field names, and timestamps.
Checklist for ETSI EN 319 142 (PAdES-B-LT & PAdES-B-LTA) Signatures
Follow these technical checks to ensure your signed documents achieve full long-term legal validity.
Digital Signature Present
Confirm document contains an active cryptographic /Sig dictionary with detached PKCS#7 or CAdES payload.
Complete Trust Chain
Ensure all intermediate CA certificates and root anchors are embedded into the /Certs dictionary.
Revocation Proofs Embedded
Verify OCSP responder tokens or CRL delta lists were captured before signer certificate expiry.
RFC 3161 Secure Timestamp
Confirm an authoritative timestamp token is embedded to establish verifiable signing time.
PDF Documents vs Signature Compliance Specifications
Comparing PAdES digital signature profiles, timestamp specifications, and long-term validation capabilities.
| Profile | Standard | Revocation Storage | Timestamp Requirements | Role | Longevity Outlook |
|---|---|---|---|---|---|
| PAdES-LTV | ETSI EN 319 142-1 | /DSS Embedded (OCSP & CRL) | RFC 3161 secure token | Source of this validation audit | Decades of autonomous legal validity without live CA dependencies |
| Audited PDF | Target Document | Analyzed in-browser memory | Evaluated against PAdES-LTV | Target of this export | Verification proof and compliance documentation for legal archiving |
| PAdES-B-B | Basic Signature | None (requires live CA servers) | Optional local clock timestamp | Baseline signature | Short-term validity expiring with signer public key certificate |
| PAdES-B-T | Timestamped Signature | None (requires online CA check) | Mandatory RFC 3161 token | Trusted timestamp | Proves signature existence at specific time; lacks embedded revocation |
| PAdES-B-LT | Long-Term Record | /DSS dictionary with full chain | Mandatory trusted timestamp | Complete validation store | Enables offline verification even after certificate authority expiry |
| ISO 32000-2 | PDF 2.0 Standard | Native Document Security Store | CAdES & PAdES SHA-256/384 | Modern ISO specification | Next-generation universal document signature and archiving standard |
Frequently Asked Questions
Technical answers regarding Document Security Store (/DSS) dictionaries, OCSP responders, CRL revocation lists, and PAdES-LTV compliance.
1What is Long-Term Validation (LTV) in PDF digital signatures?
LTV (Long-Term Validation), standardized under ETSI EN 319 142 (PAdES-LTV) and ISO 32000-2, embeds all public-key certificate chains, timestamp authority tokens, and revocation status data (CRL and OCSP) directly into the Document Security Store (DSS). This enables signatures to remain legally verifiable decades later even if the issuing Certificate Authority goes offline.
2What specific PDF dictionaries does the validator inspect for LTV?
Our engine parses low-level PDF document structures for the /DSS (Document Security Store) catalog dictionary, validating presence of /Certs arrays, /OCSPs streams, and /CRLs tables, alongside detached /Sig signature value dictionaries and RFC 3161 timestamp tokens.
3Are my signed documents or private certificates uploaded to external servers?
No. All cryptographic stream parsing, binary catalog inspection, and visual signature coordinate mapping run 100% locally in your browser memory sandbox. No document bytes or cryptographic certificates ever leave your computer.
4How do I make a non-compliant digital signature LTV-enabled?
To enable LTV on an existing signature, open the signed PDF in Adobe Acrobat Reader or an enterprise signing engine with internet access, right-click the signature panel, and select 'Add Verification Information'. This fetches current OCSP/CRL revocation lists and writes a DSS update block to the file.
5Can I export a compliance audit report for archiving or legal records?
Yes. Once validation is complete, you can download a comprehensive JSON audit report or a formatted CSV spreadsheet detailing signature identities, signing timestamps, SubFilter formats, and individual DSS/OCSP/CRL check results.
6What is the difference between basic PAdES-B and PAdES-LTV?
PAdES-B includes only the signer certificate and signature timestamp at the moment of signing, requiring live Certificate Authority servers for subsequent verification. PAdES-LTV incorporates complete revocation evidence (OCSP/CRL) and secure timestamp authority tokens directly into the PDF catalog, guaranteeing autonomous legal verification decades into the future.
Related PDF Digital Signature & Certificate Tools
Discover complementary document security, signature, and verification utilities.