How to Digitally Sign a PDF (and Get the Green Tick)

The two things people call 'signing'

The first is a drawn or typed signature — an image of your name placed on the page. It shows intent, and for everyday agreements that is genuinely enough. But it carries no proof: anyone can copy the image, and nothing stops someone editing the document afterwards without a trace. The signature and the document are not connected in any verifiable way.

The second is a cryptographic digital signature. It uses maths to bind a specific certificate to the exact bytes of the document, so the signature stands as evidence of both who signed and that nothing has changed since. This is the kind of signature banks, governments and legal contracts rely on, because it is tamper-evident in a way a drawn signature can never be.

Which you want depends on the stakes. A drawn signature is fine for consent and informal sign-off. A digital signature is what you reach for when it matters that the document cannot be quietly altered and that a recipient can verify it.

What a digital signature actually proves

A digital signature answers two questions at once: has this document been changed, and who signed it. The mechanism behind it is a hash — a short fingerprint of the document. When you sign, the tool computes that fingerprint and encrypts it with the private key inside your certificate, then embeds the result in the PDF.

A viewer can then recompute the fingerprint from the document it received, decrypt yours using the public key in your certificate, and check that the two match. If they do, the document is exactly what was signed. If a single byte has been altered since — a number changed, a line added — the fingerprints no longer match and the viewer reports the signature as invalid.

That is the tamper-evidence a picture of your handwriting cannot provide. The proof is not that the signature looks right; it is that the maths only works if the document is untouched.

Why the green 'valid' tick doesn't always appear

Here is the part that confuses people. The signature answers 'has this changed?' entirely on its own. But 'can I trust who signed it?' is a separate question, and it depends on where the certificate came from — not on the quality of the signature.

PDF viewers like Adobe Reader trust a fixed list of certificate authorities. A certificate issued by one of those authorities — after they have verified your identity — produces the automatic green tick, because the viewer already trusts the chain it hangs from. A certificate that does not chain to a trusted authority is shown as 'validity unknown' until a person explicitly chooses to trust it, no matter how sound the underlying cryptography is.

So a yellow 'validity unknown' warning does not mean the signature failed. It means the viewer does not yet recognise the signer — a policy decision on its part, not a defect in your signature.

The certificate you need — and how to get one

Personal signing certificates almost always arrive as a PKCS#12 file, with a .pfx or .p12 extension. That single file bundles your certificate together with its private key, protected by a password. If you already hold one — issued by your employer, a government eID scheme, or a paid provider — signing with it gives you the trust level that certificate carries, which is the path to the automatic green tick.

If you have no certificate, you can still produce a real signature by generating a self-signed one. It is free and takes seconds, and the resulting signature is genuinely tamper-evident. The trade-off is exactly the trust question above: viewers mark it 'validity unknown' until the recipient chooses to trust it.

• Use a certificate from a trusted authority when you need the automatic green tick — formal contracts, anything sent to strangers.
• A self-signed certificate is fine for internal documents, records you are protecting for yourself, or signing where the other party already knows you.
• Either way, keep the certificate's password safe: anyone who has both the file and the password can sign as you.

Sign without uploading anything

The private key is the most sensitive thing in this whole process. Anyone who obtains it can sign in your name, so it should never be uploaded to a server — and it does not need to be. The signing can happen entirely in your browser: the certificate is read locally, the document is hashed and signed on your own machine, and only the finished PDF is handed back to you.

That protects both the key and the document, which is frequently a contract or record you would not want sitting in a third party's logs. Because the work is local, nothing is transmitted, it keeps working offline once the page has loaded, and there is no server that could retain, inspect or leak either your key or the file you signed.

Tools mentioned in this guide