A signed digital envelope with a document inside
A .p7m file received from an Italian business, public agency or legal office is a digital envelope carrying a document with a CAdES digital signature. The file inside is usually a PDF or an XML electronic invoice. To open and read it, you need a compatible P7M viewer; a standard PDF reader cannot unpack the envelope directly. The same extension is also used for S/MIME emails, which may be encrypted.
Open a P7M file online
What does the .p7m file extension mean?
The .p7m file extension identifies a secure digital envelope based on Cryptographic Message Syntax (CMS), the successor to PKCS #7. In Italian document workflows, the CAdES (CMS Advanced Electronic Signatures) format uses this structure to wrap an electronic document together with its digital signature.
Think of the .p7m file as an envelope and the embedded document as the letter inside. The extension describes this outer envelope, not the file’s internal layout. For example, notice.pdf.p7m is a standard PDF wrapped in a signed container — not a corrupted file or an unusual PDF format.
IETF · RFC 5652: CMS SignedDataProvincia autonoma di Trento · CAdES
What is inside a P7M file?
A typical attached signature packages the original document together with cryptographic signature information and, in most cases, the signer’s digital certificate. The certificate links the signer’s identity to a public key and includes a recognized issuer and validity period.
A single document can also be signed by multiple people. Signatures can sit side by side in the same container (joint signatures), or an already signed file can be signed again (nested signatures). While a repeated suffix like .p7m.p7m suggests nested signatures, only opening the file reveals how many signatures exist and whether they are valid.
agreement.pdf.p7m- The original document
- agreement.pdf — the actual file being signed, preserved in its native format.
- Signature data
- Cryptographic values and metadata used to verify that the content has not been altered.
- Signer certificate
- Identifies the signer and the issuing certification authority. Its presence alone does not guarantee trust.
IETF · RFC 5652: CMS SignedDataProvincia autonoma di Trento · CAdES
.pdf.p7m, .xml.p7m and other file names
The filename before .p7m usually indicates what type of document is inside. What matters is the actual extracted content, since filenames can be renamed or extensions hidden by the operating system.
- notice.pdf.p7m
- Usually a signed container holding a PDF. Extracting it retrieves the original PDF, which any standard PDF reader can open.
- invoice.xml.p7m
- Usually a signed XML electronic invoice (FatturaPA). Extracting it produces an XML file, not a ready-made PDF. A dedicated invoice viewer can render it into a human-readable invoice.
- agreement.docx.p7m
- A signed envelope can hold Word documents, images, or any other file type. A P7M viewer can unpack and extract the file even if it does not preview that specific format directly.
Provincia autonoma di Trento · CAdESAgenzia delle Entrate · Electronic invoicing
Why did someone send me a P7M attachment?
The sender attached a digital signature to the file before sending it — a standard requirement for Italian business contracts, public procurement, legal notices, and electronic invoicing. Because it is a container, email apps cannot preview it inline and present it as an attachment to download.
Sending, signing, and encrypting are three distinct operations. Receiving an attachment via PEC (Italy’s certified email) confirms delivery, but does not automatically mean the attachment is digitally signed. Likewise, a .p7m extension does not guarantee that the content is safe. If a file is unexpected, verify with the sender before opening it.
Ministero dell’Interno · CAdES / PAdESBanca d’Italia · Digital signature software manual
P7M vs PDF: CAdES and PAdES
CAdES wraps any document format (PDF, XML, Word) and adds the .p7m extension. PAdES is built specifically for PDF files and keeps the standard .pdf extension. This explains why some signed documents arrive as .pdf.p7m, while others open immediately in your PDF reader.
A visible signature stamp on a page is not the same as a digital signature. CAdES does not place a visual stamp on the PDF pages, and an image of a handwritten signature provides no cryptographic protection. Furthermore, an extracted PDF may contain its own embedded PAdES signatures, which require separate verification.
| Feature | CAdES / P7M | PAdES / PDF |
|---|---|---|
| File extension | .p7m (often .pdf.p7m) | |
| Supported documents | PDF, XML, Word, images, and other types | PDF documents only |
| Signature location | In the outer cryptographic envelope | Embedded inside the PDF structure |
| How to open | Open in a P7M viewer to extract the document | Open directly in any standard PDF reader |
On small screens, swipe horizontally to compare both formats.
To learn how extraction works and how to view XML reading copies, visit the P7M to PDF guide.
Ministero dell’Interno · CAdES / PAdESBanca d’Italia · Digital signature software manual
How to open a P7M file and read the document
Save the attachment to your computer or phone, then open it in a reader that supports signed P7M files. Always keep the received original. If the container holds a PDF, the viewer will display the pages; if it holds an XML invoice, a compatible invoice viewer can present the invoice data clearly.
Simply renaming notice.pdf.p7m to notice.pdf does not remove the container, and PDF readers will report a corrupted format. The file must be properly extracted. For an XML invoice, generating a printable PDF is a visual rendering step that does not replace the official XML file or the signed P7M.
P7M Online processes documents entirely inside your browser without uploading files to any server. File opening, supported XML invoice data, technical signature checks, and viewing the first PDF page are free. Multi-page PDF previews, downloads, and printing require an export credit or plan.
To inspect a signed document directly in your browser, use our P7M viewer online.
For step-by-step instructions on Windows PCs, read opening P7M files on Windows.
On Apple computers, see how to open P7M files on Mac.
On mobile devices, see opening P7M files on iPhone and Android.
Before exporting, check our preview and export plans.
Reading a document is not the same as verifying it
Viewing the extracted document shows that the content was recovered, but it does not confirm whether the digital signature is legally valid. Full signature verification requires checking several independent technical factors:
- Integrity
- Does the cryptographic hash match the document, confirming it has not been modified since signing?
- Validity period
- Was the certificate valid when the signature was created? (A signer’s computer timestamp is not a certified timestamp).
- Trust chain
- Was the certificate issued by a recognized, trusted Certification Authority (CA / QTSP)?
- Revocation status
- Is there reliable evidence (CRL or OCSP) confirming the certificate was not suspended or revoked?
You can inspect P7M signature details in our homepage tool. It verifies integrity and certificate parameters locally without sending data over the network. These local technical checks provide quick diagnostic insight and do not replace formal legal validation.
Is smime.p7m the same kind of file?
Not necessarily. S/MIME email also uses the .p7m extension for digitally signed emails and encrypted emails. The filename smime.p7m or a note like “PKCS #7 MIME” does not tell you on its own whether the message is merely signed or encrypted.
A signed message can be opened and verified without special keys. An encrypted message, however, requires the recipient’s private key and a configured email client. P7M Online opens signed CAdES containers; it does not decrypt encrypted S/MIME email or generate new signatures. If your attachment is encrypted, open it in your email application or ask the sender for a readable copy.
Frequently asked questions about P7M files
Is a P7M file always a PDF?
No. The .p7m extension represents the signed outer container. It can contain a PDF, an XML electronic invoice, a Word document, or an image. A filename like document.pdf.p7m strongly suggests an embedded PDF, but the container must be opened to extract it.
Do I need a digital signature or smart card to open a P7M file?
No. You do not need a personal signing certificate, smart card, or digital ID to open and read a signed P7M file. A personal private key is only required if the file is an encrypted S/MIME email.
What is the difference between P7M and P7S?
A P7M file contains both the original document and the digital signature in one single file (attached signature). A .p7s file contains only a detached signature: to open or verify it, you must also have the exact original unsigned file.
Does extracting the PDF remove the signature from the original file?
No. Extraction creates an independent copy of the embedded document (such as a PDF) while keeping your original .p7m file unchanged. Always keep the original .p7m file if you need to prove its legal validity in the future.
Does the .p7m extension guarantee the document is legally valid?
No. The file extension only indicates that a cryptographic envelope was used. Legal validity depends on whether the signature is cryptographically intact and whether the signer’s certificate was valid and issued by an accredited authority.
Sources and technical references
This guide is based on established technical standards and official guidance. All filenames mentioned are illustrative examples.