host.name.my is a document signing and verification service. Sign PDFs and any file, add a trusted timestamp, and let anyone verify the result — no account required.
Built on open standards: PAdES · RFC 3161 · X.509v3 · PKCS#7
Services
Four capability groups: issue identities, sign documents, seal them in time, and prove them to anyone.
Embedded, standards-compliant PDF signatures
Sign PDFs so the signature travels inside the file. A PAdES reader checks the signature and integrity against the document bytes; import the root to confirm the signer identity.
Key capabilities
Sign any file type without changing it
For formats that cannot hold an embedded signature — Word, Excel, images, archives — produce a detached CMS/PKCS#7 signature (.p7s) over the exact file hash.
Key capabilities
Certificates and trusted timestamps
The trust layer behind every signature: certificates issued to your signers, trusted RFC 3161 timestamps, and up-to-date revocation — so a signature can be checked later.
Key capabilities
Prove it, trace it, control it
Anyone can verify a document without an account. Administrators get role-based access, certificate control and a tamper-evident audit trail.
Key capabilities
How it works
Drop a PDF or any document into the portal.
Your certificate signs the document hash — embedded or detached.
An RFC 3161 timestamp from our own TSA seals the signing time.
Share the file; anyone verifies it through the portal or QR.
Capabilities
A quick reference of supported inputs, the standard used, the output you get, and how it is timestamped.
| Input | Service / standard | Output | Timestamp |
|---|---|---|---|
| PDF document | PAdES | Signed PDF (embedded signature) | RFC 3161, embedded (B-T) |
| DOCX / XLSX / PPTX | CMS / PKCS#7 | Detached .p7s signature | Separate .tsr (original) |
| Images / ZIP / binary | CMS / PKCS#7 | Detached .p7s signature | Separate .tsr (original) |
| User identity | X.509v3 | Client certificate + private key | — |
| Revocation data | X.509 CRL | Published CRL file | — |
| Revocation check | OCSP (RFC 6960) | Live status at /ca/ocsp | — |
Use cases
Any organisation that must prove who signed what, when, and that nothing changed afterwards.
Sign agreements, letters and filings so the signed copy can be verified independently.
Offer letters, policies and acknowledgements with a verifiable signer identity.
Purchase orders, approvals and statements protected against later alteration.
Reports, drawings and change records signed at the point of issue.
Internal circulars and directives with a controlled, auditable trust root.
Certificates, transcripts and result slips that anyone can verify.
Standards & security
No proprietary formats. Everything produced here can be checked with standard tooling.
Private trust by design. Signatures verify against the dedicated root for your organisation, not a shared public CA. Recipients verify through the public portal, or import the root certificate once to validate in Adobe or OpenSSL.
The web tier never touches CA private keys. Cryptographic operations run through a dedicated, isolated helper with strict permissions.
Integration
Use the web console, or drive it from your own systems.
Upload, sign, download and verify from any modern browser — no desktop app or extension.
A documented helper tool issues, signs, timestamps, verifies and revokes from scripts.
Share a signed file; recipients verify through the public portal or a QR code.
Documents are protected and user signing keys use AES-256.
FAQ
A document signing and verification service backed by a dedicated trust domain for your organisation. Recipients verify through the public portal, or import your root certificate once to validate in Adobe or OpenSSL.
No. The verification page is public. A recipient uploads the signed PDF — or the original file plus its .p7s signature — and gets an immediate VALID or INVALID result.
Uploaded originals and signed copies are stored on the service infrastructure; access is limited to authorised users and administrators. Signatures are computed over the exact document bytes with SHA-256.
Any file. PDFs receive an embedded PAdES signature; every other format receives a detached CMS/PKCS#7 signature (.p7s).
Yes. Certificates can be revoked from the console, and the revocation list (CRL) is regenerated and published.
Timestamps use RFC 3161 and are produced by our own timestamp authority, embedded in the signature. A public timestamp authority may be used as a fallback.
No. Use Adobe Acrobat Reader, or the built-in verification page. macOS Preview does not validate PAdES signatures.
For recipients
You do not need an account. Verifying takes a few seconds.
Go to the public verification page.
PDF: upload the signed PDF. Other formats: upload the original file and its .p7s signature.
VALID means the document is authentic and has not changed since it was signed.
To validate in Adobe Acrobat, import the root certificate into your trust store first.
An administrator issues your certificate; you upload a document, sign it, and produce a signature anyone can verify.