PDF Signatures Explained: Signature Images, Digital Signatures and What the Law Says

Dropping a PNG of your handwritten signature onto the last page of a contract and emailing it back has become routine, and most recipients accept it without a second thought. Yet “signing a PDF” covers two technically unrelated things. One is a picture that imitates ink on paper. The other is a cryptographic signature mathematically bound to the document’s contents. Once you can tell them apart, the question “is this good enough?” becomes much easier to answer for yourself.

The signature image: anyone can copy it

When you place a signature image on a page with a tool like add text or image to PDF, the file gains one image object and an instruction to draw it. That image has no relationship with anything else in the document.

• Anyone can extract it and paste it into another document.
• The amount or date in the body can be edited after the image is placed, and the file keeps no trace of it.
• Nothing in the file says who placed it.

That does not make it meaningless. Legally, what a signature mostly does is show that a person agreed to the content, and that intent can be proven by other evidence: the email thread, conversations before and after, the fact that both sides went on to perform the contract. But if there is a dispute, the image itself proves very little, and the burden shifts to that surrounding evidence.

The digital signature: bound to the document by a hash and a private key

A certificate-based digital signature relies on public-key cryptography. The signer holds a private key; the matching public key sits in a certificate anyone can read. Signing a PDF works roughly like this:

1. The file is saved with an empty gap reserved for the signature data.
2. A hash is computed over every byte except that gap (the ByteRange).
3. The hash, together with attributes such as the signing time, is signed with the private key, packed with the certificate in CMS format, and written into the gap.

A verifier recomputes the hash over the same range and checks the signature value against the certificate’s public key. If a single byte changed, the hash differs; and without the private key, nobody can produce a new matching signature. So a digital signature guarantees two things: the document has not changed since signing (integrity), and it was signed by whoever holds that private key.

Who holds the key is the certificate’s job. If a certificate authority verified the signer’s identity before issuing it, viewers such as Acrobat check it against their trust list and show a green tick. A self-signed certificate that you generate yourself triggers “signer’s identity is unknown” instead. The cryptography is equally strong; the identity assurance is not.

PAdES: signatures built to last

The PDF specification (ISO 32000) defines its own signature formats, but in Europe the reference is PAdES, standardised by ETSI as EN 319 142. PAdES baseline signatures use the SubFilter ETSI.CAdES.detached and add requirements such as a signed reference to the signing certificate. The standard defines four levels:

Level	Adds	Why it matters
B-B	The basic signature	Signature plus signer certificate
B-T	A trusted timestamp	A third party vouches that the signature existed at that time
B-LT	Validation material (certificate chain, revocation data)	Can be validated even if the CA disappears or is offline
B-LTA	Document timestamps	Can be renewed so the evidence survives weakening algorithms

The levels exist because certificates expire. A personal certificate typically lasts one to three years, but a contract may be needed as evidence a decade later. To show that a signature made with a now-expired certificate was valid when it was made, you need a third party to vouch for the signing time and the revocation status at that moment stored inside the document.

The Digitally Sign PDF tool on this site signs in the basic ISO 32000 format (adbe.pkcs7.detached). That is enough for integrity and for checking the signer certificate, but there is no timestamp and no long-term validation data, so it is not a PAdES baseline signature. If an agency or counterparty specifies a format, use the software they require.

United States: the technology-neutral ESIGN Act

The Electronic Signatures in Global and National Commerce Act, signed on 30 June 2000 (15 U.S.C. § 7001 and following), covers transactions in or affecting interstate or foreign commerce. It defines an electronic signature very broadly: “an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.” A signature, contract or record “may not be denied legal effect, validity, or enforceability solely because it is in electronic form.”

Nothing in that definition requires cryptography. Depending on the circumstances, a typed name at the end of an email, a click on “I agree” or a pasted signature image can all qualify. The Act does exclude some categories, including wills and testamentary trusts, family law matters and court orders, and it imposes a separate consent process before businesses may deliver legally required consumer disclosures electronically. Most states have also adopted the Uniform Electronic Transactions Act (UETA), which follows the same approach.

Because the law is permissive about form, US disputes tend to turn on attribution and intent: can you show this person, and not someone else, adopted this signature on this version of the document? That is exactly where audit trails and cryptographic signatures earn their keep.

European Union: eIDAS and its three tiers

The EU’s eIDAS Regulation (No 910/2014), since amended by Regulation (EU) 2024/1183, sets a single framework for all member states and splits electronic signatures into three tiers:

• Simple electronic signature: any data in electronic form that a signatory attaches with intent to sign. A scanned signature or a tick box can fall here.
• Advanced electronic signature (AdES): uniquely linked to and capable of identifying the signatory, created with means under the signatory’s sole control, and linked to the data so that any later change is detectable. Certificate-based PDF signatures can meet this.
• Qualified electronic signature (QES): an advanced signature created with a qualified signature creation device and based on a qualified certificate.

Article 25 says an electronic signature must not be denied legal effect or admissibility as evidence solely because it is electronic or not qualified, and gives a qualified electronic signature the equivalent legal effect of a handwritten one. A QES based on a qualified certificate from one member state is recognised as qualified in all the others. PAdES is the standard way to carry advanced and qualified signatures inside PDF files in this framework.

Japan: signatures “only the person can make”

Japan’s Act on Electronic Signatures and Certification Business came into force on 1 April 2001. Article 3 presumes that an electronic record bearing the person’s own electronic signature, meeting certain requirements, was genuinely created by that person. The key requirement is that the signature be one “that only the person can perform”, mirroring the rule in civil procedure that a paper document bearing the person’s own seal is presumed genuine.

As cloud contracting spread from 2020, the question became whether services that sign with the provider’s own key on the user’s instruction qualify. On 4 September 2020, the Ministry of Internal Affairs and Communications, the Ministry of Justice and METI published a Q&A indicating that such signatures can fall under Article 3 when the process gives sufficient assurance that only the user could have initiated it, for example through two-factor authentication.

South Korea: the end of the “accredited certificate”

Korea’s 1999 Digital Signature Act gave a presumption of validity only to signatures made with “accredited certificates” from licensed authorities. In practice these became almost mandatory for online banking and government services, and were criticised for years, not least for the browser plug-ins they required.

The fully revised Act (No. 17354), in force since 10 December 2020, removed the concepts of accredited certificates and accredited signatures entirely. Article 3 now says that an electronic signature shall not be denied effect as a signature solely because it is electronic, and that where a statute or an agreement between the parties chooses electronic signatures as the method of signing, the chosen electronic signature has the effect of a signature. In other words, what counts is largely what the parties agreed on, not which certificate authority issued the key.

When a signature image is enough, and when it is not

Across these systems the starting point is the same: electronic does not mean invalid. So the practical question is less “is it legally effective?” than “if this goes wrong, how will I prove what was agreed?” As a general orientation, not legal advice for any particular case:

A signature image or simple e-signature is usually workable for:

• quotes and purchase orders with a long-standing counterparty, where emails already record the agreement;
• internal approvals and minutes, where the organisation has its own records;
• low-value, low-risk everyday transactions.

A certificate-based signature or a legally prescribed method is worth it for:

• documents where a statute requires a particular form, handwriting or a notary (government filings, some real estate and financial paperwork, wills);
• high-value contracts with a party whose identity you have not verified in person;
• documents where you may need to prove years later that not a single word changed after signing;
• any case where the other side explicitly demands a format, such as an EU qualified signature.

One more technical point. A digital signature reveals changes; it does not hide content. If you want to send a signed contract and also keep it confidential, you need PDF encryption as a separate step, and encrypting an already-signed file rewrites it and breaks the signature. Decide the order in advance, or use software that handles both together.