Digital signatures on PDFs: visible stamps vs real cryptographic signatures

“Sign this PDF” on the web usually means one of two very different things. One is cosmetic and the other has legal weight. Most people (and many tools) never make the distinction clear.

Two completely different concepts

Visible stamp / signature image
You draw or upload a picture of your signature (or a typed name with a flourish) and it is placed on the page like a rubber stamp. It is purely visual. Anyone can copy-paste it, remove it, or put someone else’s name there. This is what most free “sign PDF online” sites do by default.

Cryptographic digital signature (PDF signature, PAdES, CAdES)
A cryptographic signature binds the identity of a certificate holder to the exact bytes of the document (or a specific range of bytes) at the moment of signing. It is stored in a special signature field, usually with a timestamp and the certificate chain. Changing even one bit after signing invalidates it. Verifiers can check:

• That the document has not been altered since the signature was applied.
• That the signer controlled the private key corresponding to the certificate.
• (With proper certificates) that a trusted Certificate Authority vouches for the identity.

A visible stamp can sit next to a real cryptographic signature, or exist completely independently.

What the LocalTools sign-pdf tool does

The signature tool on this site produces a visible stamp (the drawn or typed signature image) placed on the page you choose. It is the same class of operation as “add watermark” or “add page numbers” — useful for indicating intent and making the document look signed to a human reader.

For a subset of use cases it can also embed a basic cryptographic signature when you supply a .p12 / .pfx file (PKCS#12). In that mode:

• A placeholder is reserved in the PDF structure (sized generously because real certificates with chains are larger than the defaults most libraries assume).
• The bytes covering the document content are hashed and signed using the private key from the P12.
• The resulting CMS/PKCS#7 object is inserted.

Even then, the visible appearance and the cryptographic signature are two separate layers. The picture can be moved or covered; the crypto signature will still attest to the content at signing time.

Why “self-signed” or test certificates show as untrusted

A signature is only as trustworthy as the certificate that created it and the chain up to a root that the verifier trusts.

• A certificate you generated yourself (common with the free tools) has no CA parent that operating systems and PDF readers have pre-trusted.
• Adobe Reader, Preview, Chrome, etc. will show a big warning: “Signature is valid but the signer’s identity could not be verified” or “Not trusted”.
• This does not mean the math is broken or the document was altered — it means “we have no reason to believe this name belongs to this key.”

For internal workflows, personal records, or “I signed this version”, a self-signed signature is often sufficient evidence of intent. For anything that will be sent to banks, courts, or government agencies, you generally need a certificate issued by a CA that is trusted in that jurisdiction (qualified electronic signature / QES in Europe, AATL in the US, etc.).

What survives email, compression, and page reordering

• Adding a visible stamp and then compressing images usually keeps the signature field intact because the content hash was taken over the parts that matter.
• Reordering pages, deleting pages, or changing any signed content after signing will break the cryptographic signature (by design).
• Many mail clients and “compress PDF” services will inadvertently break signatures by re-serializing the file.
• If you need the signature to remain valid for a third party, sign last, and avoid any further processing that rewrites the PDF structure.

Visible stamp best practices (even when there is no crypto)

• Place the signature in a consistent location (bottom right of the last page is conventional for many contracts).
• Include a date line next to it if the document does not already carry one.
• If you are only using a visible stamp, consider also typing your name and the date in plain text — it removes ambiguity for people who cannot see or do not trust the graphic.
• Watermarks and page numbers are separate concerns; you can combine them.

When you actually need the cryptographic version

• Contracts that will be relied upon by people who were not present at signing.
• Documents that may be disputed later (“did this version change after I signed it?”).
• Situations where local law or the counterparty explicitly requires a qualified or advanced electronic signature.

In those cases the right tool is usually not a free browser utility; it is a service or local application that can obtain and use a qualified certificate from an approved provider. The browser tools are excellent for the visible layer and for low-stakes cryptographic signatures.

Bottom line

A picture of a signature on a PDF page says “I intended to sign this.”
A valid cryptographic signature backed by a trusted certificate says “This exact document, at this moment, was signed by the holder of this key, and it has not changed since.”

Both have their place. The important thing is knowing which one you are actually creating.