Skip to content
ecdsa.com

XAdES Inspector

Paste or open an XML document with XAdES signatures. The inspector verifies each XML signature, works out its baseline level and checks the properties a relying party depends on.

100% local — everything runs in your browser, nothing is sent to any server

EU List of Trusted Lists (XAdES baseline B-B)

Source: The EU List of Trusted Lists as published by the European Commission on 2026-10-15, unmodified (Commission Decision 2011/833/EU). Checked as of 2026-10-20.

Up to 10 MB
Trust
Root or issuing CA certificates, PEM or base64 DER
When the signature does not carry its own
Check as ofTimes are in UTC.

What is not checked

  • Time-stamp tokens (SignatureTimeStamp, ArchiveTimeStamp) are found, counted and attributed to a level, but not opened: their time, TSA signature and message imprint are not verified.
  • Revocation data embedded for long-term validation is counted, not evaluated, and nothing is fetched: the current status of the signer certificate is not checked online.
  • A signature policy is identified and its hash reported, but the policy document is not retrieved or applied.

XML signatures with legal weight

XAdES — XML Advanced Electronic Signatures, ETSI EN 319 132-1 — is how XML documents are signed under the EU's eIDAS regulation: the trusted lists that tell browsers and PDF readers which trust service providers are qualified, e-invoices in many countries, tax filings, court documents. It is an ordinary XML signature with qualifying properties attached: who signed (a reference to the signing certificate), when (a claimed signing time), under which rules (a signature policy), what was signed (the data object formats), and — added later as unsigned properties — time-stamps and the certificates and revocation data needed to validate the signature years from now.

Baseline levels

EN 319 132-1 defines four baseline levels, each building on the previous one:

LevelAddsWhat it gives you
B-Bsigned properties: SigningCertificateV2, SigningTime, DataObjectFormat…a signature bound to its signer's certificate
B-Ta SignatureTimeStamp from a time-stamping authorityproof the signature existed at that time
B-LTcertificates and revocation data (CertificateValues, RevocationValues)validation without contacting anyone, after certificates expire
B-LTAarchive time-stamps over all of itprotection against weakened algorithms, renewable

The older forms of ETSI TS 101 903 — BES, EPES, T, C, X, X-L, A — are still common, and the inspector names both the baseline level and the legacy form it recognises from the properties present.

What the inspector verifies

For every ds:Signature in the document:

  1. The XML signature itself — every Reference resolved and digested after its transforms, and the signature value over the canonical SignedInfo — with the same code as the SAML inspector. References to content outside the document are digested from files you choose, read in the page.
  2. SignedProperties is covered. A reference of type #SignedProperties must point at the signed properties; otherwise everything XAdES adds is unsigned decoration.
  3. The signing-certificate reference: the digest and issuer/serial in SigningCertificate or SigningCertificateV2 must match the certificate that actually verifies the signature — the protection against substituting another certificate of the same key.
  4. The signing time — a valid xs:dateTime with a time zone, not in the future, inside the certificate's validity.
  5. The signer's certificate: subject, issuer, validity, and its QC statements (EN 319 412-5): whether it is an EU qualified certificate, whether the key is on a qualified signature creation device, its type (e-signature, e-seal, website) and the legislation it is qualified under. With trusted certificates you paste, the path from the signer to them is built and checked.
  6. The policy and data object formats, and the level, with notes when the properties present are inconsistent (validation data without a time-stamp, an archive time-stamp without validation data).

The example is the real EU List of Trusted Lists, an enveloped XAdES B-B signature by the European Commission with RSA-SHA512 and SigningCertificateV2, published on 15 October 2026. The XML-DSig pitfalls it shares with SAML are covered in SAML signature validation: what to check and why.