Security
What is a digital signature in a PDF, and why does my signed PDF say it has none?
A signature you can see on a page (drawn, typed, scanned or stamped) is a picture. A digital signature is invisible proof, made with a certificate, that the document has not changed since it was signed and who signed it. A PDF can show a signature and still contain no digital signature at all.
You uploaded a PDF. You can see the signature on it with your own eyes. A name in ink at the bottom, maybe an official seal. And the checker told you: "This PDF has no digital signatures."
That sounds wrong. It is not. The two sentences are talking about two different things that happen to share the word "signature". Once you see the difference, it takes about a minute to understand, and it will save you from a very common mistake.
The short version
There are two kinds of signature on a PDF:
- A signature you can see. A name drawn with a mouse, a typed name in a handwriting font, a scanned signature, a photographed seal. This is a picture placed on the page.
- A digital signature. You usually cannot see it at all. It is hidden inside the file, made with a special digital ID called a certificate, and it does one job: it proves the document has not been changed since it was signed, and who signed it.
A checker like Verify PDF Signature looks for the second kind only, because the first kind is just an image, and there is nothing in an image to check.
An everyday comparison
Think of an important letter.
- Writing your name at the bottom of the letter is like a visible signature. Anyone can see it. But anyone could also copy it onto a different letter, and the paper cannot tell.
- Putting the letter in an envelope and closing it with a wax seal is like a digital signature. If someone opens the envelope and changes a word, the seal is broken, and everyone can see it was broken.
A PDF can have the name at the bottom without the seal. That is exactly the file that says "no digital signatures".
Why a picture of a signature proves so little
A picture on a page is just pixels. It can be:
- copied from one PDF and pasted into another,
- moved to a different page,
- left in place while the text above it is quietly changed. "100" edited to "900".
After any of these, the picture still looks perfect. Nothing in the file records that anything happened. That is not a flaw in any particular app; it is simply what a picture is.
This does not mean a visible signature is worthless. For a great many everyday documents (a leave form, a delivery note, a club membership form, an internal approval) a drawn or typed signature is exactly what people expect and accept. It shows who agreed. It just cannot prove afterwards that nobody changed the document.
What a digital signature actually does
When a PDF is digitally signed, the software takes a kind of fingerprint of every byte of the document and locks that fingerprint with the signer's certificate.
Later, anyone can check it:
- If even one character of the document has changed since signing, the fingerprint no longer matches and the signature shows as invalid.
- The certificate says who signed: and, if the certificate came from a recognised authority, that identity has been checked by someone other than the signer.
- A trusted timestamp can record when it was signed, so the signature can still be checked years later, after the certificate itself has expired.
So why does my PDF say "no digital signature"?
Almost always, for one of these reasons:
- The signature was drawn, typed or pasted as an image. Most "sign" features in apps and websites (including ones that feel official) place a picture. The PDF looks signed; it contains no digital signature.
- The paper was signed and then scanned. A scan is a photograph of the page. The signature is part of that photograph.
- The file was printed to PDF, flattened, or re-saved after signing. Many "Save as PDF" and "Print to PDF" steps rebuild the file from scratch, and a digital signature does not survive being rebuilt. The visible stamp of the signature can survive while the signature itself is gone.
- The document was edited after it was signed by a program that removed the signature rather than keeping it.
In every case, what you are seeing is real (someone did sign it) but what the checker is looking for is not in the file.
"Electronic signature" and "digital signature": are they the same?
People use the words loosely, so here is the practical difference:
| Electronic signature (eSignature) | Digital signature | |
|---|---|---|
| What it is | A picture or typed name placed on the page | Invisible cryptographic proof inside the file |
| What you need | Nothing. Draw or type it | A certificate (a digital ID file, usually .pfx or .p12) |
| Shows who signed? | Only by what it says | Yes, through the certificate |
| Shows if the file changed? | No | Yes, even one character |
| Good for | Everyday forms, approvals, agreements between people who trust each other | Contracts, tenders, government and banking submissions, anything that may be disputed |
On KovaPDF:
- [Sign PDF](/sign-pdf) makes an electronic signature: draw, type or upload yours and place it on the page. No certificate needed.
- [Digital Signature](/digital-signature-pdf) makes a real digital signature with your own certificate.
- [Verify PDF Signature](/verify-pdf-signature) checks the digital signatures in any PDF, whoever made them.
Where do you get a certificate?
A certificate is issued to you. The way a passport is issued, not made at home. The usual sources:
- Your employer, bank or government office, if they issue digital IDs to staff or customers.
- A certification authority that sells document-signing certificates to individuals and businesses. In many countries a government body licenses these authorities, and only their certificates carry legal weight for official filings.
It usually arrives as a file ending in .pfx or .p12, protected by a password you choose or are given.
If you have never been given one, you almost certainly do not have one, and for most everyday documents, you do not need one. Sign PDF is the right tool.
Reading a verification result
When a PDF *does* contain a digital signature, the checker reports several things separately. They mean different things:
- Signature: valid: the document has not changed since it was signed. This is the most important line.
- Certificate: valid: the digital ID was in date and was meant for signing.
- Certificate chain: valid: the digital ID's issuer checks out too.
- Trust: whether the issuer is one this checker recognises. "Not trusted" does not mean fake. A company that issues its own certificates to staff will show as not trusted to outsiders, and that is normal.
- Timestamp: whether an independent time service recorded when it was signed.
The one thing to be wary of is "Signature: invalid". That means the document was changed after signing, or the signature itself is damaged.
Will Adobe Acrobat show a green tick?
Only if the certificate came from an authority on Adobe's own trust list. That depends entirely on who issued the certificate, not on which website or app did the signing. With any other certificate, Acrobat shows the signature as valid but the signer as "unknown", which is correct behaviour and not an error.
Common questions
I can see a signature on my PDF. Why does the checker say it has no digital signature?
Because what you can see is a picture of a signature: drawn, typed, scanned or pasted onto the page. A digital signature is something different: invisible proof inside the file, made with a certificate, that the document has not changed. A PDF can show a signature and contain no digital signature at all.
Is a drawn or typed signature on a PDF legally valid?
Often, yes. Many countries accept electronic signatures for everyday agreements, and plenty of organisations accept a drawn signature on a form. What it cannot do is prove afterwards that the document was not changed. For contracts that might be disputed, or for official filings that require it, a certificate-based digital signature is the stronger choice.
What is the difference between an electronic signature and a digital signature?
An electronic signature is any signature added electronically, usually a picture or typed name on the page. A digital signature is a specific kind of electronic signature, made with a certificate, that locks the document so any later change is detectable and shows who signed it.
I signed the paper and scanned it. Is that a digital signature?
No. A scan is a photograph of the paper, and the signature is part of that photograph. It is a visible signature only.
My PDF was digitally signed, but now the checker finds no signature. What happened?
The file was probably re-saved, printed to PDF, flattened or edited in a way that rebuilt it. Those steps can keep the picture of the signature while removing the digital signature itself. Ask the sender for the original file they signed.
How do I get a certificate to make a digital signature?
From your employer, bank or government office if they issue digital IDs, or from a licensed certification authority that sells document-signing certificates. It usually comes as a .pfx or .p12 file with a password.
The result says "Not trusted". Does that mean the signature is fake?
No. It means the certificate was issued by an authority the checker does not recognise. Very common for certificates a company issues to its own staff. If the line "Signature: valid" is there, the document has not been changed since it was signed.
Can a digital signature be copied onto another document?
No. A digital signature is tied to the exact bytes of the document it was made for. Moved to any other document (or left on the same document after a single change) it shows as invalid.