What is the P7M file format?
.p7m files are responsible for storing encrypted or digitally signed email messages and documents as a binary PKCS#7/CMS container. In such a file the content, any attachments, the cryptographic signature, and the signer's certificate chain are all stored together. The format is equally common as a general-purpose signed-document wrapper: an actual file - such as a PDF or an XML invoice - is embedded verbatim inside the .p7m shell, which adds the signature layer on top.
The container is normally DER-encoded binary (ASN.1 magic bytes 0x30 0x82 at offset 0); a Base64 text variant of the same structure also exists and starts with MII.... Unlike .p7s, which is a detached signature that keeps the source document separate, .p7m bundles the original document and signature into a single self-contained file.
Access to encrypted messages
.p7m files have one main purpose - protection of information contained within a message against unauthorised access by third parties. In order to read an encrypted .p7m it is required to possess a private key matching the public key that was used to seal the message. The recipient's private key stays the same across messages, so the target recipient has easy access to each new message without additional setup.
.p7mfiles are often used to send sensitive, protected data in medicine, financial, or business industries..p7mfiles use the Secure/Multipurpose Internet Mail Extensions (S/MIME) standard as their signing and encryption method; the underlying specification is CMS (RFC 5652).- In the EU - especially in Italy -
.p7mis the standard container for CAdES (CMS Advanced Electronic Signatures) qualified e-signatures, which carry full legal weight. - Messages signed or encrypted in
.p7mfiles usually appear under the filenamesmime.p7m.
Such .eml email messages provide only information within a header, with an empty content field visible to the mail client. The text and files of the message are contained within the encrypted or signed attachment itself. To extract the inner document or verify a signature without dedicated software, openssl smime -verify or openssl smime -decrypt are common command-line options.
Security & safety
RISK: MEDIUMA .p7m is data, not a program, so it can't execute on its own - but it carries trust meaning that matters. For SIGNED .p7m files, 'opening' is safe, but the point is to VERIFY: a valid signature tells you who signed and that the document is unaltered; check that the signer's certificate is trusted and not expired/revoked, not just that 'a signature exists'. The inner document (e.g. a PDF) still deserves normal caution once extracted. For ENCRYPTED .p7m, you need YOUR private key to decrypt - never send your private key to anyone or upload a confidential/encrypted .p7m to a random online 'opener'. Prefer official verification services (Aruba/Agid) and local tools (Dike/OpenSSL) for sensitive documents.
Format details
in a nutshellFULL NAMEPKCS#7 / S/MIME Message (digitally signed or encrypted)
DEVELOPERRSA Security (PKCS#7) / IETF (S/MIME, CMS - RFC 5652)since PKCS#7 (1990s); S/MIME / CMS standardized in RFC 5652. Heavily used for EU/Italian legal e-signatures (CAdES)
CATEGORYSecurity / Certificate Files
MIME TYPEapplication/pkcs7-mime
TYPEBinary PKCS#7/CMS container (usually DER-encoded), sometimes Base64; wraps the original file plus signature and/or encryption
STANDARDOpen · royalty-free
MAGIC BYTES · FILE SIGNATURE
OFFSET
0001
HEX
3082
ASCII
0·
A .p7m is normally a binary PKCS#7/CMS structure (DER), so it begins with the ASN.1 SEQUENCE tag 0x30 followed by a length, commonly 0x30 0x82 .... Some .p7m files are Base64-encoded text (then they start with "MII..."). The container wraps the ACTUAL document inside it together with a digital signature (signed-data) and/or encryption (enveloped-data) - the real file (a PDF, XML invoice, etc.) is extracted from within.
Programs that open P7M files
Windows4 apps
OpenSSL
Open-source Extract the inner file: 'openssl smime -verify -in file.p7m -inform DER -noverify -out document.pdf' (or 'openssl cms ...'). Add -CAfile to actually validate the signer.
Dike (InfoCert)
Free Italian/EU signed docs: open Dike, use the Verify/Open function, drag in the .p7m - it checks the signature and extracts the inner document. Free.
Aruba Sign
Free Free Aruba digital-signature app: click Verify, select the .p7m, then view/save the enclosed document and signature details. 
Adobe Acrobat Reader
Free If the .p7m wraps a PDF, Acrobat can open the signed PDF and show signature status. Works for signed PDFs; not for arbitrary encrypted .p7m. 
macOS3 apps
Aruba Sign / Dike
Free Both ship macOS builds: verify the signature and extract the document the same way as on Windows.
OpenSSL / LibreSSL
Open-source Terminal: 'openssl smime -verify -in file.p7m -inform DER -noverify -out out.pdf' to pull out the inner file. Pre-installed (LibreSSL).
Keychain Access (encrypted case)
Built-in For an S/MIME ENCRYPTED .p7m, ensure your private key/cert is in the keychain so Mail can decrypt it. Not a standalone .p7m viewer. 
Linux2 apps
OpenSSL
Open-source Pre-installed: 'openssl cms -verify -in file.p7m -inform DER -noverify -out document.pdf' extracts the inner document; add -CAfile to validate the signature.
Aruba Sign
Free Aruba provides a Linux build for verifying/extracting signed .p7m documents with a GUI.
Web1 app
Aruba / Agid online signature checkers
Free Upload a .p7m to an official signature-verification service to view the document and signature validity. Avoid uploading encrypted/confidential files to third-party sites. Technical details
deep spec| Container format | PKCS#7 / CMS (Cryptographic Message Syntax) |
| Governing specification | IETF RFC 5652 (CMS); earlier RFC 2315 (PKCS#7 v1.5) |
| MIME type | application/pkcs7-mime |
| Default S/MIME filename | smime.p7m |
| Binary encoding | DER (Distinguished Encoding Rules) - ASN.1 binary structure |
| Alternative encoding | Base64 text (starts with “MII…”) - same CMS structure, different transport encoding |
| Magic bytes (DER) | 0x30 0x82 at file offset 0 - ASN.1 SEQUENCE tag followed by a 2-byte length field |
| CMS content types | SignedData, EnvelopedData (encrypted), SignedAndEnvelopedData, CompressedData |
| EU signature profile | CAdES (CMS Advanced Electronic Signatures, ETSI EN 319 122) - supports qualified level under eIDAS |
| Embedded certificates | X.509 signer certificates and intermediate CA chain stored inside the container |
| Signing algorithms | RSA (PKCS#1 v1.5, PSS) and ECDSA; digest algorithms SHA-256, SHA-384, SHA-512 |
| Encryption algorithms | AES-128 and AES-256 (CBC/GCM); Triple-DES for legacy compatibility |
| Inner document | Any file type (PDF, XML invoice, plain text, etc.) embedded verbatim and extractable |
| Decryption requirement | Recipient's private key matching the X.509 public key certificate used during encryption |
| Legal use | Standard qualified e-signature format for Italian public administration (PA), certified email (PEC), and EU cross-border documents |
| Released | PKCS#7 (1990s); S/MIME / CMS standardized in RFC 5652. Heavily used for EU/Italian legal e-signatures (CAdES) |
| Open standard | Yes · royalty-free |
| Specification | www.rfc-editor.org |
P7M conversions
Possible
.P7M .PDFGUIDE
Yes -- open the P7M in Dike or Aruba Sign (both free), verify the signature, then save the inner document.…
How to convert
.P7M .XMLGUIDE
Yes - extract the inner XML by verifying the .p7m with Dike, Aruba Sign, or OpenSSL.
How to convert
.P7M .P7SGUIDE
P7M and P7S are two forms of the same PKCS#7 signature standard - converting between them is a technical…
How to convert
Not possible
Community Q&A
asked by users
I
Frequently asked questions
What is a .p7m file?
A digitally signed (and sometimes encrypted) document in PKCS#7/S/MIME format. The real file - often a PDF or an XML e-invoice - is wrapped inside, along with a signature proving who signed it and that it wasn't changed. It's the standard for legally valid e-signatures in Italy/EU.
How do I open a .p7m file?
Use a digital-signature tool that verifies and extracts the inner document: free DiKe (InfoCert) or Aruba Sign on Windows/Mac/Linux, Adobe Acrobat if it wraps a PDF, or OpenSSL ('openssl smime -verify -in file.p7m -inform DER -noverify -out out.pdf'). A plain text editor won't show the document.
Why is my file named something.pdf.p7m?
Because the .pdf is the original document and the .p7m is the digital-signature wrapper around it. Verify/extract the .p7m to get the inner PDF back; you can't just rename it to .pdf - it's still wrapped.
How do I extract the document from a .p7m without special software?
Use OpenSSL: 'openssl smime -verify -in file.p7m -inform DER -noverify -out document.pdf' (or 'openssl cms ...'). The -noverify flag skips trust checking just to extract; add -CAfile to also validate the signature.
Is a .p7m file encrypted or just signed?
Usually just SIGNED - the document is readable once you extract it, and the signature proves authenticity. Some .p7m files are ENCRYPTED (S/MIME), and those need the matching private key to decrypt. A signature tool or OpenSSL will tell you which it is.
Can I open a .p7m on my phone?
Yes - Aruba and InfoCert offer mobile apps to verify and view signed .p7m documents, and some PEC/e-invoice apps open them directly. For encrypted .p7m you still need your private key configured.
References
1RFC 5652 - Cryptographic Message Syntax (CMS/PKCS#7)www.rfc-editor.org
2InfoCert DiKe - free digital-signature softwarewww.firma.infocert.it
