Digital Signatures on PDFs: What They Are and How They Work

You sign a contract, email it as a PDF, and the other party questions whether it was tampered with after you signed. A handwritten signature on a printed document has witnesses, ink impressions, and physical custody to establish authenticity. A PDF needs a different mechanism — that is where digital signatures come in.

Electronic signature vs. digital signature

These terms are used interchangeably, but they are fundamentally different:

Electronic signature (e-signature)

An image of your handwritten signature, a typed name in a script font, or a checkbox saying "I agree." It indicates intent to sign but provides no cryptographic proof of identity or document integrity.

Digital signature

A cryptographic operation that uses a certificate issued by a trusted authority. It proves three things:

1. Who signed. The certificate identifies the signer.
2. When they signed. A trusted timestamp records the signing moment.
3. That nothing changed. Any modification to the document after signing invalidates the signature.

How digital signatures work (simplified)

1. The signer has a private key (kept secret) and a public key (shared via a certificate).
2. The signing software computes a hash (a unique fingerprint) of the PDF's contents.
3. The hash is encrypted with the signer's private key, creating the digital signature.
4. The signature and the certificate are embedded in the PDF.
5. When someone opens the PDF, the viewer decrypts the signature using the public key and compares the result to a fresh hash of the document. If they match, the document has not been altered.

When digital signatures matter

Legal contracts

Many jurisdictions recognise digitally signed PDFs as legally binding. The EU's eIDAS regulation, the US ESIGN Act, and similar laws in other countries provide legal frameworks.

Financial documents

Auditors and regulators may require proof that financial statements were not modified after approval.

Government submissions

Tax filings, permit applications, and regulatory reports increasingly accept or require digitally signed PDFs.

Healthcare

Patient consent forms, prescriptions, and medical records benefit from tamper-evident signatures for compliance with privacy regulations.

The role of certificate authorities

A digital signature is only as trustworthy as the certificate behind it. Certificate Authorities (CAs) are trusted organisations that verify a signer's identity before issuing a certificate. Common CAs include:

• DigiCert
• GlobalSign
• DocuSign (for document signing)
• Adobe Approved Trust List (AATL) members

A self-signed certificate proves document integrity but not identity — anyone can create one. For legal purposes, use a certificate from a recognised CA.

Preparing a PDF for signing

Before signing a PDF:

1. Finalise the content. Any edit after signing invalidates the signature. Make all changes first.
2. Set the correct page orientation. Use Rotate PDF if any pages are sideways.
3. Combine all documents. Merge PDF the pages into one file before signing. Adding pages after signing breaks the signature.
4. Compress if needed. Large files are harder to email. Compress PDF before signing, not after.

Limitations of digital signatures

• They do not prevent copying. A signed PDF can still be duplicated and distributed.
• They do not encrypt the content. Anyone can read the document. For confidentiality, use password protection in addition to signing.
• Certificate expiration. Certificates have validity periods. A signature made with an expired certificate may not validate.
• Viewer support. Not all PDF viewers validate digital signatures. Adobe Acrobat, Foxit, and most modern browsers do. Some lightweight viewers ignore them.

Frequently asked questions

Can I digitally sign a PDF for free?

Some tools offer free digital signatures with self-signed certificates. For certificates from a recognised CA, there is usually an annual fee.

Does adding a watermark invalidate a digital signature?

Yes. Any modification — including watermarking, compressing, or rotating — invalidates an existing digital signature. Always sign last.

Can I verify a digital signature in my browser?

Most browser-based PDF viewers show basic signature status. For full validation (certificate chain, timestamp verification), use Adobe Acrobat Reader (free).

What happens if the document is modified after signing?

The signature status changes to "invalid" or "document modified after signing." The viewer clearly flags that the content no longer matches what was signed.

---

Prepare documents for signing: Merge PDF, Rotate PDF, Compress PDF, or browse all converters.