A digital signature on a PDF is not the same as a handwritten signature or a typed name at the bottom of a document. It is a cryptographic mechanism that proves two things: who signed the document, and whether the document has been modified since it was signed. Here is how it actually works.
What a digital signature contains
When someone digitally signs a PDF, the software creates a hash (a fixed-length fingerprint) of the document content, encrypts that hash with the signer's private key, and embeds the result in the PDF along with a certificate. The certificate contains the signer's identity, the public key needed to verify the signature, and the timestamp of when it was applied.
How verification works
When a recipient opens a signed PDF, the PDF reader performs three checks:
- Integrity: It re-hashes the document content and compares it to the stored hash. If even one byte of the document has changed, the hashes will not match, and the reader will flag the signature as invalid.
- Authenticity: It uses the signer's public key (from the embedded certificate) to verify that the signature was created by the claimed private key. This confirms the signer's identity.
- Trust: It checks whether the signer's certificate chains back to a trusted Certificate Authority (CA) — a third party that vouches for identities. If the certificate is self-signed or issued by an unknown CA, the reader will warn that the signature cannot be trusted.
What changes break a signature
Any modification to the signed document invalidates the signature — editing text, adding annotations, inserting pages, or even re-saving the PDF with different compression settings. This is by design: the signature guarantees the document is exactly as it was when signed. If you need to modify a signed document, you must create a new version and apply a fresh signature.
Practical use cases
Digital signatures are used in contracts, government filings, financial documents, and any situation where proving document integrity matters. They carry legal weight in most jurisdictions, including under the ESIGN Act in the United States and eIDAS in the European Union. For everyday documents where you just need to indicate approval or acknowledgment, a digital signature may be more rigorous than necessary — but for legally binding agreements, it provides verifiable proof that the document has not been altered.