What is the P7S file format?
A .p7s file is an email attachment secured with a digital signature. It does not contain the email body itself - it carries only the cryptographic signature and the signer's X.509 certificate, while the message body remains a separate, readable part of the email.
Digital signature guarantees that the email was not modified in transit and verifies that the sender is who they claim to be. It thus precludes the possibility of the message being tampered with by a third party if captured in transit.
Digital signature support
Email messages are digitally signed using PKCS #7 (Public-Key Cryptography Standard) technology, now standardized by the IETF as CMS (Cryptographic Message Syntax, RFC 5652). The .p7s file is stored in DER binary encoding or, less commonly, as PEM Base64 text starting with -----BEGIN PKCS7-----. Its MIME type is application/pkcs7-signature.
To verify such a message, a user needs to use an email client that supports this standard. Most email applications - including Microsoft Outlook, Apple Mail, and Mozilla Thunderbird - recognize digital signatures automatically. When an email client does not support S/MIME, the .p7s file appears as a visible attachment named smime.p7s, showing raw binary or Base64 data rather than readable text. To inspect its contents from the command line, use openssl pkcs7 -in smime.p7s -print_certs -noout.
A closely related format is .p7m, which wraps both the message and signature into a single signed or encrypted bundle.
Security & safety
RISK: LOWA p7s file is itself harmless - it's signature/certificate data with no executable code, and it protects you by proving a message or document is authentic and unmodified. Real pitfalls are about interpretation, not infection: (1) 'signed' is not 'encrypted' - a signed email's body is still sent in the clear; (2) a valid signature proves the sender's identity and integrity, NOT that the content is trustworthy (a bad actor with a valid cert can sign a bad message); (3) verification is only as good as the certificate's trust chain, so a 'valid' badge from an untrusted/self-signed cert means little. Treat a surprise smime.p7s as a sign the email is legitimately signed, then judge the sender on the message itself.
Format details
in a nutshellPrograms that open P7S files
Windows3 apps
Mozilla Thunderbird
Open-source Free S/MIME-capable mail client; open the signed message and Thunderbird verifies the signature and shows the certificate. Best free option. 
OpenSSL
Open-source To inspect/verify a document signature: 'openssl pkcs7 -inform DER -in smime.p7s -print_certs -text' (view), or 'openssl smime -verify' to validate against the signed file. 
Microsoft Outlook
Paid Open the signed email in Outlook (S/MIME-capable): it reads smime.p7s automatically and shows a red-ribbon 'signed' badge - no need to open the .p7s yourself. 
macOS3 apps
Mozilla Thunderbird
Open-source Free S/MIME client on macOS; verifies the signature and shows the signing certificate. 
Apple Mail
Built-in Open the signed email in Mail (with the sender's certificate trusted): it processes smime.p7s and marks the message as signed. Don't open the attachment directly.
OpenSSL (Terminal)
Open-source Use 'openssl pkcs7'/'openssl smime -verify' in Terminal to inspect or verify a detached .p7s document signature. 
Linux2 apps
Mozilla Thunderbird
Open-source Open the signed email; Thunderbird verifies the S/MIME signature and displays the certificate.
OpenSSL
Open-source Pre-installed on most distros: 'openssl pkcs7 -in smime.p7s -inform DER -print_certs' to view the signer cert; 'openssl smime -verify' to validate. Technical details
deep spec| Full name | PKCS #7 / S/MIME Digital Signature |
| MIME type | application/pkcs7-signature |
| Binary encoding | DER (ASN.1 Distinguished Encoding Rules) - produces a compact binary file |
| Text-armored variant | PEM: Base64 data between -----BEGIN PKCS7----- and -----END PKCS7----- markers |
| Magic bytes (DER) | 0x30 0x82 at offset 0 - ASN.1 SEQUENCE tag followed by a 2-byte length field |
| Data structure | ASN.1 SEQUENCE encapsulating a CMS SignedData object as defined in RFC 5652 |
| Typical filename in email | smime.p7s - the fixed name mandated by the S/MIME standard |
| Content carried | Cryptographic signature value plus one or more embedded X.509 v3 signer certificates |
| Signature type | Detached - email body stays in a separate MIME part, readable without the .p7s file |
| Signing algorithms | RSA, DSA, ECDSA - determined by the key type in the signer's X.509 certificate |
| Digest algorithms | SHA-256, SHA-384, SHA-512; SHA-1 deprecated per RFC 8419 and RFC 9325 |
| Certificate format | X.509 v3; the full certificate chain may be embedded to support offline validation |
| Governing specification | CMS RFC 5652, superseding the original PKCS #7 v1.5 and RFC 2630 |
| Trust model | CA-based PKI - signature validity requires a certificate chain to a trusted Certificate Authority |
| Released | PKCS #7 v1.5 (1993, RSA); S/MIME v2 RFC 2311 (1998); CMS RFC 5652 (2009) |
| Open standard | Yes · royalty-free |
| Specification | www.rfc-editor.org |
P7S conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about P7S files.
