Digital Signature PDF

Add a cryptographic digital signature to your PDF using X.509 certificates. Supports PKCS#12 (.pfx, .p12) and PEM formats. Your private key never leaves your browser.

Internet connection required

Signing may need to fetch certificate chain information from your certificate issuer's server to validate the signature.

Click to select a file or drag and drop

PDF Documents

Your files never leave your device.

How It Works

1

Upload PDF

Select the PDF document you want to sign

2

Upload Certificate

Provide your .pfx or .p12 certificate file and password

3

Sign & Download

Apply the digital signature and download your signed PDF

Related PDF Tools

Encrypt PDF

Password protect your PDF

Decrypt PDF

Remove PDF password

Flatten PDF

Make annotations permanent

Sanitize PDF

Remove hidden data

Change Permissions

Set PDF permissions

Frequently Asked Questions

What is the difference between Digital Signature and Sign PDF?

Sign PDF places a drawn, typed, or uploaded picture of your signature on the page; it's visual only. This tool applies a cryptographic PKCS#7 signature using your X.509 certificate, so a PDF reader can verify who signed and detect any change made afterward. You can also show a visible signature block at the same time.

Can I sign with a PEM certificate instead of a .pfx or .p12 file?

Yes. Upload a single .pem file that contains both the certificate and the private key. Encrypted private keys work too; enter the key password in the Certificate Password field. If your certificate and key are in separate PEM files, paste them into one file first.

Do I need an internet connection to sign?

Often, yes. The signing library fetches the issuer certificate chain from the URLs in your certificate's Authority Information Access extension, and if those servers can't be reached, signing fails for certificates that need chain validation. Your PDF and private key are never part of those requests; only the certificate URLs are fetched.

Why does Adobe Reader say the signature validity is unknown?

The reader can't trace the certificate back to a root it trusts. That's expected for self-signed certificates, which are fine for testing but always show a warning. For documents other people need to rely on, use a certificate issued by a Certificate Authority that PDF readers trust.

Do I have to add a visible signature on the page?

No. The cryptographic signature is embedded whether or not the visible block is enabled. Turn on Visible Signature if you want a stamp on the page: pick the first, last, all, or a specific page, set the position and size in points, and add a PNG, JPG, or WebP image or a line of text; with neither, the tool writes the certificate's common name and the current date.

What are the Reason, Location, and Contact Info fields for?

They're optional metadata stored inside the signature itself. Reason records why you signed, such as "Approved" or "Reviewed", Location where it happened, and Contact Info how to reach you. PDF readers display them in the signature panel.

Can a digitally signed PDF still be edited?

The file can still be opened and edited, but any change made after signing breaks the integrity check and readers will report the document as modified. If the PDF has form fields or annotations that should be fixed in place, run it through Flatten PDF before signing, not after.

How can I check that the signature was applied correctly?

Open the signed file in Validate Signature. It lists every signature, shows the signer and issuer, checks the certificate dates, and confirms whether the bytes have changed since signing. You can also load your CA certificate there to verify the trust chain.