What certificate formats are supported?

PKCS#12 bundles (.pfx and .p12) containing your private key and certificate. RSA and ECDSA keys are supported; the certificate chain inside the bundle is embedded in the signature automatically.

Is this signature legally valid?

A cryptographic signature with a valid certificate is recognized in most jurisdictions (eIDAS in the EU, ESIGN/UETA in the US). Whether a specific document requires a qualified certificate from a trust-service provider depends on local law — for everyday contracts and approvals, a standard certificate signature is what Acrobat produces too.

What is the difference between this and the Sign PDF tool?

Sign PDF pastes a drawn or typed signature image onto pages — a visual mark only. Digital Sign PDF embeds a CMS/PKCS#7 cryptographic signature that verifiably binds your certificate to the document's exact bytes and detects any later modification.

Does my private key get uploaded?

No. The .pfx is parsed locally, the key is imported into WebCrypto on your device, and the signature is computed in the browser. Nothing — not the key, not the file, not the hash — is sent anywhere.

Can I sign with a visible stamp and still get cryptographic proof?

Yes. Visible mode draws an appearance (name, reason, date, optional image) on the page AND embeds the same CMS signature. The stamp is cosmetic; the cryptographic proof is identical either way.

How do recipients verify the signature?

Any standards-based PDF reader (Acrobat, Foxit, most browser viewers) shows a signature panel with validity status. You can also drop the signed file into our Validate Signature tool for a full report — signer, chain, signing time, and tamper check.

What if my certificate is self-signed?

The signature still proves integrity and binds the document to your certificate, but verifiers will report the signer as not trusted by a known CA. For documents that must convince third parties, use a certificate issued by a recognized authority.

ลงลายเซ็นดิจิทัล PDF ด้วยใบรับรอง X.509 ฟรี

ลงลายเซ็น PDF ด้วยใบรับรอง X.509 จริง สร้างลายเซ็น CMS แบบมองเห็นหรือซ่อน พร้อมเหตุผลและสถานที่ ทำงานทั้งหมดในเบราว์เซอร์ของคุณ

1. Select PDF

Select a PDF file from your device. Signing happens locally in your browser.

2. Load certificate

Upload your PKCS#12 (.pfx/.p12) certificate and enter its password.

3. Configure

Pick visible or invisible, set position, reason and location.

4. Download

Get a signed PDF any reader can verify — Acrobat shows the signature panel.

Real digital signatures, not drawn ones

What a digital signature actually is

A drawn signature is a picture pasted onto a page — it proves nothing and any editor can move or remove it. A digital signature is a CMS (PKCS#7) cryptographic structure embedded in the file itself: it binds your X.509 certificate to a hash of the exact bytes you signed. Change one byte afterwards and every PDF reader flags the document as modified.

This tool produces that real thing. You load a PKCS#12 bundle (.pfx or .p12) containing your private key and certificate, and the tool writes a signature dictionary with a proper /ByteRange and /Contents into the PDF — the same structure Adobe Acrobat creates. The result opens in Acrobat, Foxit, or any standards-based reader with the signature panel populated.

Visible or invisible

A visible signature also draws an appearance on a page you choose — signer name, reason, date, and optionally a scanned signature image — so a printed copy still shows the mark. An invisible signature embeds the same cryptographic proof with no visual stamp, which is what you want for integrity-only sealing of contracts, invoices, and audit exports.

Reason and location fields are recorded inside the signature dictionary itself, so verifiers see 'Approved for release — Jakarta' rather than guessing.

What you can configure

Every part of the signature is under your control.

PKCS#12 certificates

Load .pfx or .p12 bundles; the certificate chain rides inside the signature so verifiers can walk it.

Visible appearance

Nine-position placement grid, size control, optional signature image, and toggles for name/reason/date lines.

Invisible mode

Zero-rectangle signature field: pure integrity and authenticity proof with no visual change.

Tamper evidence

The signature covers the whole file byte range. Any later edit — even one byte — breaks verification.

Private by construction

Your .pfx never leaves the device. The private key is imported into the browser's WebCrypto engine as non-extractable for the signing operation, the CMS blob is built locally, and the finished file is generated in memory. There is no server round-trip at any point — you can disconnect from the network and signing still works.

Pair this tool with Validate Signature to check incoming signed PDFs, or with Timestamp PDF to add a trusted RFC 3161 timestamp that proves when the signed document existed.