How to Verify a Code Signature From the Command Line

Verify signed software from a terminal without opening a graphical interface. Use SignTool for Windows Authenticode files, jarsigner for Java archives, and codesign for macOS applications.

Core workflow: Choose the platform tool → Verify the signature → Inspect signer and trust → Review warnings → Gate the release

Select the toolSignTool, jarsigner, or codesign

→

Run verificationUse the right command and policy

→

Review diagnosticsCheck integrity, signer, chain, and timestamp

→

Automate checksBlock release when required checks fail

→

Which Command Should You Use?

The verification command depends on the software format and operating system. These tools use different platform specific policies, so a successful result on one platform does not guarantee trust on another.

Platform or file type	Verification tool	Example
Windows EXE, MSI and other Authenticode files	SignTool	`signtool verify /pa /v "MyApplication.exe"`
Java JAR files	jarsigner	`jarsigner -verify -verbose -certs "MyApplication.jar"`
macOS application bundles	codesign	`codesign --verify --deep --strict --verbose=2 "MyApp.app"`
macOS Gatekeeper assessment	spctl	`spctl --assess --type execute --verbose "MyApp.app"`

Verify Windows Software With SignTool

SignTool checks EXE files, MSI installers and other Authenticode signed files. Microsoft distributes it with the Windows SDK.

Verify an EXE or MSI

Verify an EXE filesigntool verify /pa /v "C:\\Releases\\MyApplication.exe"

Verify an MSI installersigntool verify /pa /v "C:\\Releases\\MyInstaller.msi"

Review the output for signature status, signer certificate details and warnings.

Verify a file signed through a catalog

Some Windows files rely on catalog signatures rather than embedded signatures. SignTool supports catalog searching with /a.

Search catalog databasessigntool verify /a "C:\\Windows\\System32\\example.dll"

For a specific catalog and file, use:

Verify against a specific catalogsigntool verify /pa /v /c "DriverPackage.cat" "DriverFile.sys"

The second command is useful when verifying a file against a known catalog. Driver verification requirements can differ from ordinary desktop application verification.

Check the command's exit code

In PowerShell, inspect the most recent native command's exit code:

PowerShell

signtool verify /pa /v "MyApplication.exe"
$LASTEXITCODE

Exit code	Meaning
`0`	Verification succeeded.
`1`	Verification failed.
`2`	Verification completed with warnings.

Always review diagnostic output as well as the exit code.

Choose a certificate for Windows software

For software distributed on Windows, compare code signing options suited to Authenticode applications and installers.

Explore Windows code signing certificates

Verify Java JAR Files With jarsigner

Java's jarsigner utility verifies signatures on signed JAR archives and can display information about their signers.

Basic verification

Basic commandjarsigner -verify MyApplication.jar

Detailed verification

Include entry and certificate detailsjarsigner -verify -verbose -certs MyApplication.jar

Option	Purpose
`-verify`	Checks the JAR signature.
`-verbose`	Displays details about archive entries.
`-certs`	Includes signer certificate information.

A successful verification normally displays jar verified. Examine warnings carefully. A valid JAR signature does not necessarily mean that the signer is trusted by every Java runtime or that all certificate and revocation checks have been performed.

Verify macOS Applications With codesign

Apple provides the codesign utility to inspect and verify signed applications, bundles and executable code.

Verify an application bundlecodesign --verify --deep --strict --verbose=2 "MyApp.app"

Option	Purpose
`--verify`	Checks the signature.
`--deep`	Checks nested code.
`--strict`	Applies stricter validation.
`--verbose=2`	Provides diagnostic information.

Use the output to check whether the application conforms to relevant code signing requirements.

Assess Gatekeeper acceptance

To assess whether macOS accepts an application under the applicable security policy, run:

Gatekeeper assessmentspctl --assess --type execute --verbose "MyApp.app"

This differs from checking the signature alone. Gatekeeper assessment considers the system's applicable trust and security policies. For the platform-specific process, follow the macOS application signing workflow.

See How to Sign macOS Applications for the full signing workflow.

Prepare signed software for macOS distribution

Review certificate options for signing macOS applications and supporting your release workflow.

Explore macOS code signing certificates

Understand Common Verification Results

Result	Meaning	What to do
Signature verified	The signature passed the selected verification checks.	Confirm that the signer is expected.
No signature found	No signature was found in the location or format checked.	Check whether the file is unsigned or catalog signed.
Digest or integrity mismatch	Signed content may have changed.	Compare with the original release artifact.
Certificate not trusted	The certificate chain could not be trusted under the selected policy.	Inspect the chain and trust configuration.
Timestamp warning	Timestamp information may be missing or could not be validated. See the software timestamping process when investigating this result.	Inspect timestamp and certificate details.
Verification warning	The tool identified a condition requiring review.	Read the full diagnostic output.

The exact wording varies by tool and platform. Do not treat every warning as proof of tampering, but do not ignore warnings without understanding their cause. If verification continues to fail, use the code signing error troubleshooting steps to investigate the cause.

Automate Signature Verification in CI/CD

Command line verification is useful in automated release workflows. A pipeline can verify a signed artifact before it is published or deployed.

A simple Windows PowerShell workflow might look like this:

PowerShell release check

signtool verify /pa /v "release.exe"

if ($LASTEXITCODE -ne 0) {
    throw "Code signature verification failed."
}

This example stops the PowerShell script if SignTool returns a nonzero exit code. For production use, define how the pipeline handles warnings, certificate status, timestamps and platform specific verification requirements. See the automated code signing workflow for release integration considerations.

Release control: Verify the same final artifact that will be released. If a signed file is modified afterward, its signature may no longer be valid.

Run verification after signing

Make signature validation a required stage before publishing the artifact.

Keep the final artifact unchanged

Do not rebuild, patch, or modify the signed file after verification.

Handle warnings deliberately

Set clear release rules for warnings, timestamps, certificate status, and platform requirements.

Keep useful logs

Retain diagnostic output so failed verification can be investigated.

Related guide: How to Sign Software in a CI/CD Pipeline.

Standardize signature verification across releases

Teams distributing software at scale can align signing, verification, and release controls with an appropriate certificate strategy.

Explore enterprise code signing

Frequently Asked Questions

Can I verify a code signature without opening the file?

Yes. SignTool, jarsigner and codesign can verify signatures from a terminal without executing the application.

Which command verifies a Windows EXE?

Use signtool verify /pa /v "MyApplication.exe". The /pa option selects the default Authenticode verification policy.

Which command verifies a Java JAR?

Use jarsigner -verify -verbose -certs MyApplication.jar to check the JAR signature and display additional signer and certificate information.

Which command verifies a macOS application?

Use codesign --verify --deep --strict --verbose=2 "MyApp.app". You can separately use spctl to assess acceptance under the applicable macOS security policy.

Does successful verification mean the software is safe?

No. Verification helps establish signature integrity and signer information. It does not guarantee that software is free from malware, vulnerabilities or unwanted behavior.

Can code signature verification be automated?

Yes. Verification commands can run in scripts and CI/CD pipelines, allowing a release to be blocked when required signature checks fail.