How to sign a PDF without uploading it, and which kind of signature you actually need

For the ordinary case (a contract, a form, a letter of consent), open it in PACT, draw or type your signature, give your name and capacity, and it appends a signature page carrying your mark, the date and time, and the SHA-256 of the document you signed, plus a separate certificate file recording the hash of the signed result. That is an electronic signature with an integrity record, and in most of the world it is legally effective. It is not a certificate-based digital signature, and this page is clear about which is which because almost nothing else is. If you have been issued a certificate as a .p12 or .pfx file and need that kind, PDF Studio signs with it, as part of OBSCURA Pro. Nothing is uploaded either way.

Three things called "signing"

Which one are you being asked for

Almost always the second, and often people say "digitally sign" when they mean it. The test is simple: if the other side wants a certificate-based signature, they will tell you, because they will need to tell you whose certificate authority they accept. Contracts, NDAs, consent forms, engagement letters, school forms, landlord paperwork and the vast majority of commercial agreements take an electronic signature.

Where you genuinely need the third kind: filings with some courts and registries, qualified electronic signatures under eIDAS in the EU, some regulated financial and medical documents, and anything where a specific standard is named in the instructions. If a named standard appears, this is not your tool, and that is said here rather than discovered later.

Signing with a .p12 or .pfx certificate

A certificate you have been issued usually arrives as a PKCS #12 file, ending .p12 or .pfx, holding the certificate and its private key behind a password. Most answers to how to sign a PDF with one are code for a programming library, or Acrobat. PDF Studio opens the file with its password in the browser tab and writes the signature into the PDF: in a box you drag, in an empty signature field, or invisibly. The signature covers every byte of the file but itself, and is added after the file as it was, so a second signer's signature leaves the first one valid. Every signature in a file is then checked: whether the file has changed since, whether the signature matches its certificate, and who the certificate names.

What it does and does not do is said on its page before anybody pays. It can add a trusted timestamp: tick the box and the SHA-256 hash of the signature, and nothing else, goes through this site to a free public time-stamping authority, whose signed token of the time is kept in the signature; without it, or offline, the time is your computer's clock. It does not check whether the certificate's issuer should be trusted; a reader like Acrobat does that against its own list. It adds no long-term validation data, and it cannot open a certificate file protected with the old RC2 cipher. It can make a certificate for you, which is useful for testing and for signatures between people who already know each other, but a reader will not show a certificate made that way as verified. PDF Studio is US$4 a month or US$35 a year on its own, or part of OBSCURA Pro at US$9 a month or US$79 a year, with 7 days free; it is not free.

What the integrity record buys you

The weakness of a pasted-in signature is not the picture. It is that nothing ties the picture to a particular document, so a page can be swapped afterwards and nobody can show it. The hash closes that: the certificate records the SHA-256 of the file as signed, so if a figure changes in clause 4 next March, the hash of the document no longer matches the certificate, and that is demonstrable rather than arguable.

Keep the certificate file. It is small, and it is the half that does the work: a signed PDF without it is back to being a picture.

Checking a signature somebody sent you

Two different checks, for the two different kinds.

• Signed here: PACT will check a signed PDF against its certificate and say whether the bytes still match.
• Certificate-based: PDFSIG opens a PDF that carries a real embedded signature, hashes the bytes the signature actually covers, compares that against the digest inside it, and, importantly, shows you every byte the signature does not cover. That last part is where the real-world attacks live: a signature can be perfectly valid over pages 1 to 3 of a document that now has a page 4.

Filling it in before you sign it

Most documents that need signing also need filling in. PDF fills form fields, adds text to a page that has no fields, and lets you put a signature where it belongs in the page rather than on a sheet at the end. FLATTEN then burns the filled fields into the page so they cannot be edited back, which is worth doing before sending a completed form anywhere.

Why not upload it

The documents people sign are contracts, settlements, employment terms, tenancy agreements and medical consents. An e-signature service keeps a copy by design; that is part of what it sells, and for a business with a compliance obligation it may be exactly right. For an individual signing one contract, it means a copy of an agreement about your money or your health sitting on a third party's servers, permanently, usually behind an account you will forget. Signing in the tab leaves the document where it was.

The short version