Authenticity Seal
Proves a PDF is the original, unaltered file, with a Nexinon HMAC signature.
Sealing and verifying happen almost entirely in your browser: building the seal, computing the SHA-256 hash and checking the result. Nexinon's server is involved for exactly one thing, which requires a secret only it has: signing (or checking the signature of) that hash with HMAC. Without that step, anyone could forge a PDF saying "sealed by Nexinon" by running the same calculation themselves — the server is what makes the guarantee real. None of the document's content ever reaches it, is ever logged, or stays retained anywhere.
What this seal proves (and what it doesn't)
It proves a specific PDF hasn't changed since the moment it was sealed — an integrity guarantee, anchored by an HMAC signature only Nexinon can produce. It's not a legal identity signature (unlike the PDF Signature Verifier, which reads an existing ICP-Brasil signature already in the document, with a real person's identity and formal legal validity): there's no CPF, digital certificate, or notarization involved here — just proof the file is the same as before.
How "Seal" works
Your browser builds the final PDF (the original document plus a new seal page) with a reserved slot for the signature, computes the SHA-256 hash of the whole file except that slot, and sends only that hash to Nexinon's server. The server signs the hash with an HMAC secret only it has and returns the signature, which the browser writes into the reserved slot. The document never leaves your browser — only 32 bytes of hash travel, each way.
How "Verify" works
Your browser recomputes the hash of the same byte range covered by each seal found in the file and asks the server to check the signature. Three outcomes are possible: authentic and intact (nothing changed); modified after this seal (the signature is genuine, but the content changed afterward); or never truly sealed by Nexinon (the signature doesn't check out — someone tried to forge the seal's format).
Sealing an already-sealed document again
"Seal" never replaces a previous seal — it always adds a new one on top, covering everything that already existed up to that point (including the previous seal). When verifying, each seal shows its own independent verdict, in chronological order: an older seal whose content was later changed correctly shows as "modified after this seal" — that's the truth — while the most recent seal, covering the document as it stands now, shows as "authentic and intact". The tool shows the document's real history, never pretending it never changed.
Why this needs a server
A calculation done only in the browser proves nothing more than internal consistency ("the hash matches the content"), never who sealed it — anyone could run the same algorithm and write "Sealed by Nexinon" in the footer. For that claim to be a real guarantee, Nexinon's server signs the hash with an HMAC secret only it holds. This is the only tool in the catalog's file-integrity family that isn't 100% local — and even so, the file itself is never uploaded, only its hash.
Zero retention — not even Nexinon knows the document exists
No record is kept: no database, no content logging, no history of who sealed what. The entire proof lives inside the PDF file itself, never on the server. The server's secret key can be rotated in the future without invalidating old seals — Nexinon accepts a small list of historical keys to verify, even after the current key changes.
Frequently asked questions
No. Sealing and verifying are free and require no sign-up.
With the vast majority. Some PDFs use an internal optimization (compressed objects) this version doesn't recognize yet — if that happens, the tool tells you exactly why, instead of producing an incorrect seal.
No. The file never leaves your browser, in either operation — only a 32-byte hash is sent to the server, not enough to reconstruct the original content.
No. It's a technical integrity proof, not an identity signature. To verify an existing ICP-Brasil signature already in a PDF, use the PDF Signature Verifier.
Only PDF in this version — it's the format where the technique used (a reserved byte range) works well and where Nexinon already has proven experience.
Nexinon Principles
Hybrid
Hybrid execution — part in your browser, part on the server; the page details what each side seesNo account needed
Use it now, no account or password.Free
No usage limits, no paid plan.Trustworthy content
Full explanation behind every tool, not just the result.