ETEAO
PDF Tools

    Search by tool name, description, or keyword. ↑↓ to move, Enter to open, Esc to close.

    Digitally Sign PDF

    Sign with a PFX/P12 certificate and verify existing signatures

    1Choose file2Settings3Process4Save

    Choose a PDF and its contents will be analyzed and shown here.

    Files are processed only in this browser. Nothing is uploaded to a server.

    Sign with a PFX/P12 certificate and verify existing signatures

    Continue in another tool
    Task settings
    Settings
    Verify only: checks the signatures in the document and leaves the file untouched

    Remove the password from an encrypted PDF first. Processing focuses on page content, so bookmarks, attachments, forms and signatures may not be preserved. Keep the original and check the result.

    About Digitally Sign PDF

    What this tool adds is a cryptographic digital signature, not a picture of a signature. It takes the RSA private key and certificate from a PFX/P12 file, signs a SHA-256 hash of the document bytes, and stores the resulting CMS (PKCS #7) data in a PDF signature field. The box you see on the page (name, reason, date, and an optional seal PNG) is only the signature's appearance; validation uses the invisible CMS data.

    The second mode is verification. It finds every signature in the document and checks whether the signed byte range covers the whole file, whether the hash of that range matches the value inside the signature, and whether the signature value checks out against the signer certificate's public key. It then shows the certificate's name, issuer and validity period. Verify mode never modifies the file.

    A signature image versus a digital signature

    A PNG of your handwritten signature pasted onto a page can be copied onto any other document, and the text around it can be edited afterwards without leaving a trace. A digital signature signs a hash of the whole document with a private key, so changing a single byte after signing changes the hash and validation fails. And only the holder of the private key can produce it.

    If you add a seal PNG in this tool, both things happen at once. The image is drawn in the signature box's appearance, and underneath it sits the real CMS signature. Nothing stops someone from copying the image, but the signature does not travel with a copied picture.

    Exactly which signature format this is

    The signature dictionary uses /Filter /Adobe.PPKLite and /SubFilter /adbe.pkcs7.detached. That is the basic PDF signature format defined in ISO 32000, validated by Acrobat and most viewers. The digest is SHA-256, the algorithm is RSA with PKCS #1 v1.5 padding, and a signingTime attribute is included.

    It is not a PAdES baseline signature (ETSI EN 319 142-1). PAdES baseline profiles use the SubFilter ETSI.CAdES.detached and require attributes such as a reference to the signing certificate; this tool does not produce that format. It also lacks the following:

    • Timestamps (RFC 3161): the signing time comes from your computer's clock, not a time-stamping authority, so a wrong clock records a wrong time.
    • Long-term validation (LTV): no revocation data (CRLs or OCSP responses) is embedded. Once the certificate expires, the document alone cannot show that it was valid at signing time.
    • Change-permission checks (DocMDP): a new signature is appended as an incremental update, so earlier signatures stay valid. When verifying, though, the tool does not judge whether an update appended after a signature is another signature or altered page content.
    • ECDSA keys: only PFX files containing an RSA private key are accepted. Choosing an ECDSA certificate stops with that reason, and ECDSA signatures are not verified; the report says why.

    What a Valid result does and does not mean

    Valid here means the mathematical checks passed: the file has not changed since signing, and the signature value matches the public key of the certificate embedded in the document. The tool does not check that certificate against a trust list, and it does not query CRLs or OCSP for revocation. Anyone can create a self-signed certificate with any name on it, so a Valid signature does not prove who the signer is. Confirm the certificate's issuer and fingerprint with the signer through another channel, or open the file in a viewer with a trust list, such as Acrobat. The verification report states this limit next to the result and shows the certificate's SHA-256 fingerprint for that comparison.

    A result saying the byte range does not cover the whole file matters too. If the range ends at a complete earlier revision (ending in %%EOF) and what follows is an incremental update, the tool shows the range as “whole earlier revision” and judges validity on whether that signed revision is intact. The appended content could be a legitimate additional signature or altered page content, and the tool does not inspect it. A range that falls short in any other way is invalid.

    Which certificates work

    Any PFX/P12 file exported together with its private key. That includes a document-signing certificate from your employer, a personal certificate issued by a certificate authority, or a self-signed certificate made with OpenSSL. Documents signed with a self-signed certificate show up in Acrobat as signed by an unknown identity; recipients have to add your certificate to their trusted certificates before the signature turns green.

    Worked examples

    Editing one figure after signing

    Input
    A signed contract opened in another editor, $10,000 changed to $15,000 and saved
    Output
    Verification: hash mismatch (file rewritten), or signed range “whole earlier revision — incremental update after it” (saved incrementally)

    An editor that rewrites the file changes the hash. One that saves incrementally leaves the signed revision intact, so the signature stays valid, but the report's signed range shows that content was appended. The tool doesn't judge that content, so when you see it, compare with the original you signed.

    A quote signed with a self-signed certificate

    Input
    A self-signed PFX created with OpenSSL, with a seal PNG
    Output
    This tool: Valid. Acrobat: signature intact, but signer identity unknown

    Integrity is guaranteed; identity depends on whether the recipient trusts the certificate. Exchanging certificate fingerprints with a client in advance makes this workable.

    Two people signing in sequence

    Input
    A signs with this tool, then B signs with this tool
    Output
    Both A's and B's signatures are valid (A's signed range: whole earlier revision)

    B's signature is appended to the file A signed as an incremental update, so not one byte A signed changes. The same holds if the chain continues in another program such as Acrobat.

    How to use it

    1. Choose a PDF and pick Add signature or Verify only.
    2. To sign: provide the PFX/P12 file and password, then set the page, box position, text and optional seal image.
    3. Run it; the signed file is produced and verified straight away.

    Key terms

    CMS (PKCS #7)
    The data format holding the signature value, signer certificate and signed attributes. It goes into the signature's /Contents.
    ByteRange
    The parts of the file covered by the signature: everything except the gap reserved for the signature data.
    PAdES
    The European PDF advanced electronic signature format defined in ETSI EN 319 142, with levels for timestamps and long-term validation.
    Self-signed certificate
    A certificate you issue to yourself without a certificate authority. It works cryptographically but vouches for no identity.

    Frequently asked questions

    Is adding a seal image enough to make a digital signature?

    In this tool the image always comes with a real CMS signature. If you just want to place a picture, use the add text or image to PDF tool, but then there is no tamper detection.

    Is this a PAdES signature?

    No. It is adbe.pkcs7.detached, without a timestamp or long-term validation data. Where PAdES or a qualified signature is required, use a dedicated signing service.

    If verification says Valid, can I trust it?

    You can trust that the file has not changed since signing. Certificate trust and revocation are not checked, so confirm the signer's identity separately.

    Can I add a trusted timestamp?

    No. A timestamp requires a request to a time-stamping authority, which this in-browser tool does not make. The time shown comes from your computer's clock.

    Where do my certificate and password go?

    The PFX file and password are read inside this page to create the signature and are not stored. On a shared computer, also make sure the PFX file itself does not stay in the downloads folder.

    Related guides

    Sources

    Last reviewed:

    Privacy and how data is handled

    Related tools

    PDF Tools