Convert a P7M file to PDF

Quick answer

1. Drop the .p7m (or .xml.p7m / .pdf.p7m) onto the box above.
2. If the envelope holds a PDF, press Download — you get the original PDF, byte for byte.
3. If it holds an Italian e-invoice (FatturaPA XML), read it with English labels, then press Download PDF for a courtesy A4 copy — or use the browser’s Print → Save as PDF.

No account, no upload. Opening one file at a time is free. For dozens of files, a ZIP of PDFs and an Excel register, see Pro (€19.99 one-time, VAT included, 14-day refund).

Two different jobs: extract vs render

“P7M to PDF” is a loose phrase. A .p7m is not a document format; it is a CAdES cryptographic envelope (PKCS#7 / CMS) around whatever was signed. What you get as a PDF depends on the payload:

• .pdf.p7m — the envelope already contains a PDF (a signed contract, lease, court filing, quote…). You do not convert anything: you extract the PDF. The bytes match what was signed.
• .xml.p7m — typically an Italian electronic invoice (fattura elettronica / FatturaPA). Inside is structured XML, not a page layout. A readable PDF must be rendered from those fields. That PDF is a courtesy copy; the legally relevant invoice remains the XML (and the signed .xml.p7m).

Double extensions are the clue: contract.pdf.p7m vs IT01234567890_00001.xml.p7m. If the name lies, ApriP7M still detects the real type from the content and shows it above the preview.

From .pdf.p7m to PDF

1. Drop the file on the box (or choose it from your device).
2. You see a PDF preview and who signed it, plus an integrity result (“Signature intact” or “Signature NOT intact”).
3. Press Download. The saved file is the original PDF, without the CAdES wrapper.

The extracted PDF is perfect to read, print or forward. It is not still digitally signed: the CAdES signature lives in the .p7m envelope. Keep the original .p7m whenever you need proof of who signed. (A different story is PAdES, where the signature sits inside a normal .pdf — ApriP7M does not verify PAdES signatures.)

From Italian .xml.p7m (FatturaPA) to a readable PDF

Raw FatturaPA XML is meant for software, not for humans. ApriP7M recognises the invoice and shows it like a normal bill, with English labels and the Italian terms in brackets where an accountant expects them (cedente/prestatore = supplier, cessionario/committente = customer, natura IVA, modalità di pagamento, and so on).

• Download PDF — builds an A4 PDF with header, lines, VAT summary, totals, payment details and signer.
• Print / Save as PDF — uses the browser print dialog on a clean layout (invoice only, no chrome). Choose “Save as PDF” as the printer.

Codes such as TD01 (invoice), MP05 (bank transfer) or N6.x (reverse charge) are spelled out in English next to the code. Line descriptions written by the supplier stay as written, usually in Italian. Embedded attachments (often a PDF the supplier included) download with one click.

Steps with ApriP7M (phone included)

Works in Chrome, Edge, Firefox and Safari on Windows, Mac, Linux, iPhone and Android. On a phone, save the attachment from Mail, WhatsApp or your PEC app into Files / Downloads first, then pick it from the box. After the first visit the page can work offline. For the wider “what is a .p7m?” overview, see How to open a .p7m file.

What is checked — and what is not

ApriP7M checks cryptographic integrity: the content still matches the signature, and it shows the certificate (name, Italian tax code / codice fiscale when present, certificate authority, validity period). That is not a qualified verification. It does not consult the EU trusted lists, the Italian AgID trust list, or certificate revocation / OCSP status, and it cannot declare a document legally valid.

If you need an official validation for a tender, lawsuit or formal filing, use a qualified validator: for example Poste Italiane’s free Verificatore On Line (VOL) at vol.postecert.poste.it, or the desktop tools from certificate authorities such as Infocert Sign or Aruba Sign. Those services (or installs) can check trust and revocation; many of them also upload the file or require software. ApriP7M is an independent service with no link to those providers — it is for reading, extracting and archiving without uploading.

openssl for technical users

On Linux, macOS or Git Bash on Windows (OpenSSL 3), you can extract the payload without a browser. We re-tested these commands on OpenSSL 3.5 with our fixtures:

openssl cms -verify -noverify -binary -inform DER -in contract.pdf.p7m -out contract.pdf

-noverify skips the certificate-chain check and only extracts (plus an integrity check of the content). -binary keeps binary payloads intact. Prefer cms over the older smime subcommand for CAdES.

Important: on OpenSSL 3, a failed integrity check (“CMS Verification failure”) still writes the -out file. Do not treat that output as the signed document — delete it:

for f in *.p7m; do
  out="${f%.p7m}"
  if openssl cms -verify -noverify -binary -inform DER -in "$f" -out "$out" 2>/dev/null; then
    echo "Extracted: $out"
  else
    rm -f "$out"
    echo "Not extracted (altered or invalid): $f"
  fi
done

From a .pdf.p7m you get the PDF; from a FatturaPA .xml.p7m you get raw XML — not a readable PDF. For invoices, drop the file on the box above (or the extracted XML) to render and download a PDF.

Some PEC mailboxes save the attachment as Base64 (often starting with MII…) or PEM. Decode with the system tool first — not openssl base64 -d, which in our tests can write an empty file with no error on a single long Base64 line:

base64 -di invoice.xml.p7m > invoice.der
openssl cms -verify -noverify -binary -inform DER -in invoice.der -out invoice.xml

Nested envelopes (.p7m.p7m) need a second pass. ApriP7M unwraps nested signatures automatically.

Many files at once

Free: open one file at a time, no daily limit and no sign-up. Select several files and the free plan opens the first and tells you about the rest. The openssl loop above extracts payloads in bulk for free, but invoices stay as XML.

Pro (€19.99 one-time, VAT included, up to 3 devices, 14-day refund): drop dozens of files, a folder or a ZIP; processing stays in your browser. Then download a ZIP of PDFs (readable PDF + original XML for invoices; extracted originals for other documents) and an Excel / CSV register (supplier, number, date, net, VAT, total). Details on the pricing page.

If something goes wrong

• “This does not look like a signed envelope” — truncated download, wrong file, or not a P7M. Re-download from the email or PEC.
• Base64 / PEM from PEC — drop it anyway; ApriP7M accepts Base64 and PEM. On the command line, use base64 -di first.
• Extracted “PDF” will not open — the payload may not be a PDF despite the name. Check the type shown above the preview.
• You only see XML tags — that is an e-invoice payload; use Download PDF on this page rather than openssl alone.
• The file is called smime.p7m — it is an S/MIME e-mail, not a signed document; the PDFs you want are attachments inside it. See smime.p7m files.