Looking up the transparency-log entry...
Resolving ?logIndex or ?uuid against rekor.sigstore.dev.
Public-log entry
- Public log
- Log index
- Entry UUID
- Artifact SHA-256
- Signer
Inspect the signed PDF
The Rekor card above proves the signature was published to a public log. Drop the signed PDF below to also read what is embedded inside the file - signer subject, CA chain, signing time, embedded TSA, PAdES profile, and the YubiKey attestation block when present. Parsing runs entirely in your browser; nothing about the file leaves this page.
Drop a signed PDF here
or
Attestation record
Integrity
- PDF SHA-256
- Signed range SHA
- Rekor anchor
- Rekor hash
- Signature standard
- Sig dict filter
- Signed byte range
Signer certificate
- Subject
- Issuer (CA)
- Serial
- Valid from
- Valid to
- Signature algo
- Public key
- Cert SHA-256
Signing attributes
- Signing time
- Hash algorithm
- Reason
- Location
- Contact
- Signer name
Timestamp authority
- Authority
- Issued at
- Token serial
CA chain
YubiKey attestation
- YubiKey serial
- Firmware
- PIV slot
- PIN policy
- Touch policy
- Form factor
- FIPS mode
Could not verify
If you reached this page by scanning a QR code on a signed
PDF, the URL should carry either a ?logIndex= or
?uuid= parameter pointing at a Rekor entry. You
can also drop the PDF on the box above to read the embedded
signature details without a Rekor entry.
What this page does
It looks up a Sigstore Rekor
entry by either log index (?logIndex=N) or UUID
(?uuid=hex) and decodes it into the cert,
signature, and artifact hash that were submitted at sign
time. Rekor is an append-only public transparency log; once
an entry is committed it cannot be rewritten.
When you also drop the signed PDF, the page walks the embedded PAdES / CMS structure entirely in your browser to surface the signer's X.509 certificate, the CA chain, the signing time, the embedded RFC 3161 timestamp, and - when the key lives on a YubiKey - the attestation block (firmware version, serial, PIV slot, PIN policy, touch policy, form factor, FIPS mode).
Lookups go directly to rekor.sigstore.dev. PDF
parsing runs locally. No backend, no server-side log, no
cookies, no analytics.