Check the code signature of a Windows file

Drop a Windows executable or library to read its Authenticode signature: the signer and certificate chain, the timestamp, nested signatures, and whether the file still matches the signed hash. The file is read locally and never uploaded.

What you can do

• Signer, publisher name and certificate chain
• File hash check against the signed digest
• RFC 3161 and legacy Authenticode timestamps
• Nested (dual) signatures
• Works with .exe, .dll, .sys and other PE files

Frequently asked questions

Why is a signature still valid after the certificate expired?

If the file was timestamped, Windows checks the certificate at the signing time recorded in the timestamp, not today. Without a timestamp, the signature stops being trusted when the certificate expires.

What is a dual or nested signature?

A second signature stored inside the first, typically SHA-1 plus SHA-256, so both old and new versions of Windows accept the file. PKIScope lists each one.

Can I check MSI or CAB installers?

Not yet. MSI and CAB files are recognised, but only PE files such as .exe, .dll and .sys can be checked today.

Related tools

• PKCS#7 / CMS — Open P7S, P7M and P7B files and verify signed data
• PDF signatures — Check every signature in a PDF and see why Adobe calls it invalid
• iOS profile — Inspect an Apple provisioning profile