PDF digital signatures explained: why any change breaks them

Electronic signature or digital signature?

The terms are often mixed up. In EU law (the eIDAS regulation), an electronic signature is very broad: data in electronic form attached to or logically associated with other data, used to sign. The European Commission notes that typing your name under an email might qualify.

An advanced electronic signature must also be uniquely linked to the signatory and able to identify them, be created in a way the signatory keeps control of, and be linked to the document so that any later change is detectable. A qualified electronic signature adds a qualified signature creation device and a qualified certificate. According to the Commission, only qualified signatures are explicitly recognised across the EU as having the same legal effect as a handwritten one.

A digital signature is the cryptographic technique behind most advanced signatures: certificates and keys from a public-key infrastructure. A picture of your handwriting pasted onto a page is not one.

How a digital signature locks the bytes

NIST's Digital Signature Standard describes the mechanism. The document is first reduced to a short, fixed-length fingerprint by a hash function. The signer's private key turns that fingerprint into the signature. Anyone can check it with the matching public key, which proves the content was not modified after signing.

One question remains: whose public key is it? That is what a certificate is for. It binds a person's or organisation's identity to a public key, and it is issued within a public-key infrastructure.

What a reader tells you

When you open a signed PDF, the reader runs that check and reports the result. In broad terms there are three outcomes. The signature is valid and the signer's certificate is trusted: you usually see a green tick. The document was changed after signing: the reader flags it. Or the bytes match but the reader doesn't know the certificate's root, so it can't confirm who signed.

Look at the signature details, not only at the name printed on the page. Anyone can type a name; only the check tells you whether the file is the one that was signed.

Changes a signature can survive

PDF lets software add incremental updates: new data appended to the end of the file without touching the earlier bytes. That is how a second person can sign after the first, and the first signature's hash still matches. A careful reader still looks at what the update changed, and identifies the document as changed if the page content itself was modified.

Why merging, compressing or unlocking breaks it

Tools that merge, split, reorder, compress or unlock a PDF build a new file. The pages may look identical, but the bytes are different, so the hash no longer matches and the signature no longer validates. This applies to our tools too: editing or unlocking a signed PDF makes its signature fail, because the file changed. They don't add signatures either.

A safe workflow

The rule is edit first, sign last.

• Put the pages in their final order, rotate and delete what you need, and combine files before anyone signs.
• Check the finished document carefully, then sign it or send it for signature.
• Keep the signed original exactly as received. Store it, don't re-save it.
• If you need a different version later, make it from the unsigned source and sign again.
• When you forward a signed file, send the original rather than a converted or compressed copy.