How to Verify Code-Signed Software on Windows
Check who signed a Windows software file and whether its signed content has changed. Use File Explorer for a quick inspection or Microsoft's SignTool for detailed verification of digital signatures, publisher identity, certificate trust, and timestamps.
What You Need Before Verifying a Signature
Identify the file you want to check. Common Windows file types include EXE application files, MSI installer packages, DLL libraries, CAB packages, and other files signed using Windows Authenticode.
For command line verification, use SignTool, a Microsoft utility distributed with the Windows SDK. The Microsoft Authenticode signing model provides useful context for interpreting Windows software signatures. If it is not installed or available in your terminal, install the appropriate Windows SDK component or run SignTool using its installed path.
File Explorer
Useful for manually checking a downloaded application and reviewing the signer details shown by Windows.
SignTool
Useful for detailed verification, repeatable checks, troubleshooting, and automated workflows.
Verify a Digital Signature Using File Explorer
This is the simplest method when you want to check a downloaded Windows application manually.
Step 1: Open file properties
Find the EXE or DLL file in File Explorer. Right click the file and select Properties.
Step 2: Open Digital Signatures
Select the Digital Signatures tab if it is available. A signed file may display one or more signature entries.
Step 3: Inspect the signature
Select a signature, click Details, and review the signer information and Windows signature status.
If the tab is missing
An absent or empty tab does not by itself prove that a file is malicious. The file may be unsigned, or its signature may be stored in a catalog rather than embedded directly in the file.
Signing Windows software for distribution?
Choose a certificate intended for Windows executables and installers, then verify the signed release before publishing it.
Verify a Signature Using SignTool
SignTool is more useful when you need detailed results, repeatable checks, or automated verification.
Step 1: Install or locate SignTool
SignTool is included with the Windows SDK. Its executable is usually located in a versioned Windows Kits directory.
Step 2: Run the verification command
signtool verify /pa /v "C:\\Path\\To\\MyApplication.exe"Replace the example path with your file's actual path.
| Option | Purpose |
|---|---|
/pa | Applies the default Authenticode verification policy. |
/v | Displays detailed verification information. |
Microsoft documents /pa for Authenticode verification because SignTool otherwise uses the Windows driver verification policy by default.
Step 3: Interpret the result
Verification succeeds
The signature passed the selected verification policy. Still check that the signer is the publisher you expected.
Verification fails
Investigate possible file modifications, missing or untrusted certificates, certificate status, or an incorrect verification policy.
Verification produces warnings
Read the full output. SignTool returns exit code 0 for success, 1 for failure, and 2 for completion with warnings.
Verify DLL Files and Catalog-Signed Files
Some Windows system files and drivers use catalog signatures instead of an embedded signature. In those cases, the appropriate verification command depends on the catalog and file involved.
For a file that may be signed in a catalog, Microsoft documents this command:
signtool verify /a "C:\\Path\\To\\SystemFile.dll"The /a option searches catalog databases first and, if no catalog signature is found, attempts to verify an embedded signature.
/pa check alone proves that a driver satisfies Windows driver signing requirements.How to Check the Publisher and Certificate
After verification, inspect the certificate details and confirm the signer is the publisher you expected.
Common Windows Code Signing Verification Errors
| Problem | What to investigate |
|---|---|
| No signature found | Confirm that the file is signed and whether it uses catalog signing. |
| File digest or signature mismatch | Check whether the file changed after signing. |
| Certificate not trusted | Inspect the certificate chain and local trust configuration. |
| Certificate expired | Review certificate dates and timestamp validation. |
| Timestamp error | Check timestamp information and its certificate chain. |
| Driver signature rejected | Verify under the correct driver signing policy. |
For more detailed command examples, the command line code signature verification workflow covers additional checks and output interpretation.
Publishing software with Microsoft Authenticode?
Review certificate options for Authenticode signing and establish a repeatable verification process for every release.
Frequently Asked Questions
How do I verify an EXE file on Windows?
Run signtool verify /pa /v "MyApplication.exe" or inspect the file's Properties and Digital Signatures tab.
Does a valid signature mean an application is safe?
No. A valid signature helps establish the signer and detect changes to signed content, but it does not guarantee that the software is free from malware or vulnerabilities.
Can I verify a signature without installing the application?
Yes. File Explorer and SignTool can inspect signatures without executing the application.
Why does SignTool fail when a file is signed?
SignTool may be using a verification policy that does not match the file. For ordinary Authenticode software, try /pa. If verification still fails, review the detailed output and certificate trust information.
How can I verify a driver signature?
Driver signing has specific Windows verification policies and may involve catalog signatures. Use the appropriate driver verification process rather than relying only on the default Authenticode policy.
Related Code Signing Guides
Continue with signature verification, command line checks, timestamping, and troubleshooting.
Choose a signing certificate suited to your Windows software
After verifying the signature, make sure future releases use a certificate and signing process appropriate for your publisher identity and distribution requirements.