Open P7M files
A .p7m file is a document sealed inside a digital signature, and most computers can't open it. Drop it here to get the original PDF, XML or other file back, see who signed it and when, and check that it hasn't changed since. It all happens in your browser.
Loading the tool…
Files are processed on this device and never uploaded.How to check
What a .p7m file is
A .p7m is an envelope. Inside it are the original document, one or more digital signatures, and the certificate of each person who signed. The format is called CAdES, a European standard built on the older PKCS#7, which is where the extension comes from. The document keeps its own name in front: contract.pdf.p7m holds contract.pdf, invoice.xml.p7m holds invoice.xml.
Your computer sees one unfamiliar file and has no app for it. Open the envelope and the document inside is the same file the signer had, byte for byte.
Why you get them in Italy
Italian law gives a qualified digital signature (firma digitale) the same value as a handwritten one, and many of the signing apps that come with Italian signature kits save a CAdES envelope unless you ask for a signed PDF instead. So signed contracts, documents filed with public offices and papers sent by accountants and notaries often arrive as .p7m, usually as attachments to a PEC, the Italian certified email.
E-invoices are the other big source. Invoices sent to public offices have to be signed, and a CAdES envelope is one of the two accepted ways to do it, so many of them travel as .xml.p7m. Invoices between businesses can be signed the same way. When the document inside is an e-invoice, this page tells you, and the e-invoice viewer shows it as a readable page.
Signed twice: .p7m.p7m
When a second person signs a file that is already signed, many apps wrap the whole envelope in a new one. The result ends in .p7m.p7m and holds two envelopes, one inside the other. This page opens them all, up to five, and lists the signers of each envelope, starting from the outer one, which is the signature added last. One envelope can also hold several signatures side by side; you see each of them.
What the check covers, and what it doesn’t
For every signature, the page checks two things. First, that the document’s fingerprint matches the one the signer sealed, which proves that not a single byte has changed since. Second, that the signature was made with the private key belonging to the certificate in the file. If both hold, the line turns green.
What it can’t see from inside your browser: whether the certificate comes from a qualified provider on the European trusted lists, and whether it was revoked before the signature, for example because the smart card was lost. Both need an online check with the authority that issued it. A timestamp attached to the file is noted but not checked either. For a verification with legal value, use one of the verifiers listed by AgID (page in Italian).
Private by design
The files are read from your disk and opened in this browser tab, and the signature is checked with the cryptography built into your browser. Nothing is sent anywhere, which matters for contracts and invoices full of names and tax codes. If the document inside is a PDF you need to tidy up, Merge PDF and Compress PDF work the same way.
Frequently asked questions
Are my files uploaded?
No. This page opens the envelope and checks the signature inside your browser tab, with the browser's own cryptography. Nothing goes over the network, which you can check in your browser's developer tools while you use it.
Does a green result mean the signature is legally valid?
Not on its own. Green means the document is exactly what was signed and the signature was made with the key of the certificate in the file. It does not prove that the certificate is a qualified one or that it hadn't been revoked when the file was signed; that takes an online check with the authority that issued it. For a check with legal value, use one of the verifiers listed by AgID, the Italian digital agency.
Why does it say my file holds only the signature?
Some signatures travel separately from the document they sign. A .p7s file, or a .p7m saved that way, holds the signature and the certificate but not the document itself, so there is nothing to extract. You need the original file that came with it. The smime.p7s attached to every PEC message is this kind: it is the provider's signature on the email, and your documents are the other attachments.
What is a .p7m.p7m file?
A document signed twice: someone signed it, then a second person signed the already signed file, so the first envelope sits inside a second one. This page opens every envelope, up to five, and lists the signers of each, outermost first.
Is the PDF I download still signed?
No. The signature lives in the envelope, not in the PDF, so the file you save is the plain original. Keep the .p7m if you may ever need to prove who signed it.