Digital Signature
A cryptographic signature embedded in a PDF that verifies the identity of the signer and confirms the document has not been altered since signing.
A digital signature in a PDF is a cryptographic mechanism that does two things simultaneously: it confirms who signed the document, and it proves that nothing in the document has changed since the signature was applied. These two guarantees — authentication and integrity — are what distinguish a digital signature from a simple image of a handwritten signature.
When a person applies a digital signature to a PDF, their PDF software performs a mathematical operation on the document's content using the signer's private key (a secret value stored in a certificate). The result is an encrypted hash value embedded in the signature field. Anyone who later opens the PDF can use the signer's public key — distributed via a certificate authority — to verify that the hash matches the document's current content.
If even one byte of the PDF changes after signing — even a single metadata field — the hash will no longer match and the signature will show as invalid. This makes digital signatures far more trustworthy than electronic signatures for legally sensitive documents.
How digital signatures work technically
The signing process follows the Public Key Infrastructure (PKI) model:
1. The signer obtains a digital certificate from a Certificate Authority (CA) — a trusted organisation like DigiCert, GlobalSign, or a government CA. The certificate contains the signer's public key and their identity (name, email, organisation).
2. When signing a PDF, the software computes a cryptographic hash (typically SHA-256) of the document content at that moment.
3. The hash is encrypted with the signer's private key, producing the signature value. This encrypted hash is embedded in the PDF signature field along with the certificate.
4. When a reader opens the signed PDF, their software decrypts the signature value using the signer's public key, recomputes the hash from the current document content, and checks whether they match. If they match and the certificate chain is trusted, the signature is valid.
Signature types: approval vs certification
PDF supports two distinct levels of digital signature:
**Approval signature** — Added by reviewers to indicate they have seen and approved the document. Multiple approval signatures can be applied sequentially to the same document (a workflow where person A signs, then person B signs, and so on). Each subsequent signature locks in the state of the document at the time of signing, so you can see the full approval chain.
**Certification signature** — Applied once, typically by the document's author, to certify the document as authentic. A certification signature can optionally specify what changes are permitted without invalidating it — for example, form filling and comments may be allowed, but page additions are not. Only one certification signature can exist on a document.
Certificates and trust chains
A digital signature is only as trustworthy as the certificate backing it. Certificates are issued by Certificate Authorities (CAs). Your PDF viewer has a list of CAs it trusts by default — typically the same root CAs trusted by your operating system or browser.
If a signer uses a certificate from an untrusted CA, viewers will warn that the signature cannot be verified. If the certificate has expired, the signature may still be technically valid (if a timestamp proves it was signed before expiry), but viewers will display a warning.
Self-signed certificates — where someone generates their own certificate without a CA — provide integrity checking (change detection) but no identity verification, since anyone could create a self-signed certificate in any name.
Digital signatures vs electronic signatures
The terms are often confused. An electronic signature is any electronic method of indicating agreement — a typed name, a drawn image, a checkbox tick, or a click-to-agree. It has legal validity under laws like the US eSign Act and EU eIDAS, but it provides no technical proof of identity or tamper-evidence.
A digital signature is a specific type of electronic signature backed by PKI cryptography. It provides both legal intent (the person chose to sign) and technical proof (the document has not changed and the identity is verified). Advanced Electronic Signatures (AES) and Qualified Electronic Signatures (QES) under eIDAS are digital signatures meeting progressively stricter identity verification requirements.
For everyday use — signing a contract with someone you trust — an electronic signature is usually sufficient. For high-value, regulated, or court-admissible documents, a digital signature with a qualified certificate is the appropriate standard.
Frequently asked questions
What is a digital signature in a PDF?
A digital signature is a cryptographic mechanism embedded in a PDF that proves who signed the document and guarantees it has not been altered since signing. It uses Public Key Infrastructure (PKI) — the signer's private key encrypts a hash of the document, and anyone can verify it using the signer's public certificate.
What is the difference between a digital signature and an electronic signature?
An electronic signature is any electronic indicator of intent to sign — a typed name, drawn image, or checkbox tick. A digital signature is a specific, cryptographically verified type of electronic signature that proves identity and detects tampering. Digital signatures are more legally robust for high-value or regulated documents.
Can a digitally signed PDF be edited?
If the document is changed after a digital signature is applied, the signature becomes invalid — most PDF viewers will show a warning. A certification signature can optionally permit specific changes (like form filling) without breaking the signature, but unrestricted editing invalidates it.
Do I need Adobe Acrobat to apply a digital signature?
No. Many tools support PKI-based digital signatures, including Adobe Acrobat, Foxit, and various command-line tools. The graphical signature tool in PDFTheGuide produces a visual image signature; for a certified PKI digital signature you need a tool that integrates with your digital certificate.
How do I verify a digital signature in a PDF?
Open the PDF in a viewer that supports signature validation (Adobe Reader, Chrome, Foxit). The viewer will check the certificate chain, verify the document hash, and display a status — typically a green checkmark for valid, or a warning for invalid or untrusted signatures.