Why does my government PDF show a yellow question mark?

Indian government PDFs are digitally signed using certificates from NIC, eMudhra, or other CCA India licensed authorities. Adobe Acrobat and most PDF viewers don't include India's Root Certifying Authority (RCAI) in their default trusted certificate store. So even though the signature is completely valid and legally recognised under the Information Technology Act 2000, your PDF viewer shows a yellow question mark because it cannot automatically verify the issuer. Kagazo checks your PDF against the actual CCA India trust hierarchy and gives you a copy with a permanent green tick visible on any device.

Is my document safe? Do you store my PDF?

Your PDF is processed entirely in memory during verification. We never write your file to disk, never store it on our servers, and never share it with any third party. The file is deleted from memory immediately after verification is complete. You can also verify this by checking our open source backend code.

Which documents does Kagazo support?

Kagazo supports any PDF digitally signed under India's CCA certificate hierarchy. This includes e-Aadhaar, PAN card, DigiLocker documents, ITR-V, Form 16, and all state government certificates from Tamil Nadu e-District, AP and Telangana MeeSeva, Karnataka Nadakacheri and eJanma, Kerala Sevana portal, and more.

My Aadhaar PDF is password protected. Will it work?

Yes. Enter your Aadhaar password (first four letters of your name in capital letters followed by your birth year, for example RAMA1995) in the password field that appears after you upload your e-Aadhaar PDF. We decrypt it in memory, verify the signature, and return a verified copy.

What is the difference between "Signature Valid" and "Signature Unknown"?

Signature Valid means the document is genuinely issued by the government authority and has not been modified. Signature Unknown means your PDF viewer cannot verify the certificate chain — this is a viewer configuration issue, not a problem with your document. Signature Invalid means the document may have been tampered with or re-saved after signing.

Does this work on mobile?

Yes. Kagazo is fully mobile responsive and works on any Android or iOS browser. No app installation required. Simply open kagazo.in on your phone browser, upload your PDF and verify instantly.

Real-Time HTTP Response Analysis • Security Posture Audit

HTTP Headers Checker & Security Auditor

Inspect all HTTP response headers sent by any web server. Evaluate HSTS, CSP, X-Frame-Options, and server latency with a comprehensive security scorecard.

Security Scorecard Latency Benchmarks cURL Command Export

Quick samples:

Crucial HTTP Security Headers Explained

Modern web standards mandate key headers to harden websites against common attack vectors:

Strict-Transport-Security (HSTS)

Instructs browsers to never load the site using insecure HTTP and automatically converts all attempts to secure HTTPS.

X-Frame-Options

Protects your visitors against clickjacking by determining whether a page can be loaded inside an `<iframe>`, `<frame>`, or `<object>`.

Content-Security-Policy (CSP)

Restricts which scripts, styles, and images can execute, blocking malicious cross-site scripting and unauthorized data exfiltration.

X-Content-Type-Options: nosniff

Prevents browsers from MIME-type sniffing a response away from the declared content-type, blocking script execution disguised as images.

Frequently Asked Questions

What are HTTP headers and why do they matter?

HTTP response headers are metadata transmitted by a web server alongside requested HTML content. They define caching rules (Cache-Control), content types (Content-Type), server technology, and critical browser security policies.

What is HSTS (Strict-Transport-Security)?

HSTS forces web browsers to interact with your website exclusively over secure HTTPS connections, preventing SSL-stripping and man-in-the-middle attacks.

What is a Content Security Policy (CSP)?

A Content Security Policy restricts the resources (such as JavaScript, CSS, Images, and Fonts) that the browser is allowed to load for a given page, drastically reducing the risk of Cross-Site Scripting (XSS) attacks.

Why should I hide "Server" or "X-Powered-By" headers?

Disclosing exact web server versions (e.g. Apache/2.4.41 or Express/4.17.1) helps malicious bots target known vulnerabilities specific to that version. Suppressing these headers is considered a defense-in-depth best practice.