OpenToola Guides
Digital Signatures on PDF: Visual Mark, Certificate or Qualified Signature?
Tell the difference between a drawn signature, a cryptographic PDF signature and a qualified electronic signature, and know which one a document actually needs.
Three documents can look signed and mean very different things. One has a drawn signature placed on the page. One has a cryptographic signature that turns invalid if a single character changes. One has a qualified electronic signature backed by a certificate and a trust service. Only the last one is what a bank, a court or a government portal may mean when it asks for a “digital signature”.
The confusion is common because the same word is used for a picture of a signature, a PDF signature field and a legal instrument. This guide separates the three, explains what a reader can verify, and points out where a visual signature is enough and where it is not.
The visual signature
A visual signature is an image or a drawing placed on the page. It may look like a handwritten signature, a typed name in a script font, or a company stamp. It is a mark, not a cryptographic proof.
OpenToola’s Sign PDF tool creates a visual signature. You draw or type it, place it on the page, and download the PDF. The file looks signed, and many recipients will accept it for everyday documents. But the PDF does not contain a certificate, and a reader cannot tell whether the page was changed after the signature was placed.
A visual signature is reasonable for a lease between two people, a freelance contract, a delivery note or a school form. It is not a substitute for a qualified signature when the law or the recipient requires one.
The cryptographic PDF signature
A cryptographic signature uses a private key and a certificate. The signing software computes a hash of the document, signs the hash with the private key, and embeds the signature and the certificate in the PDF. A reader can verify that the document has not changed since signing and that the certificate belongs to the stated signer, if the certificate chain is trusted.
A valid signature usually shows a green check or a similar indicator in Adobe Acrobat or another PDF reader. The reader may also show the signer’s name, the signing time, the certificate issuer and whether the certificate is trusted.
If the document is modified after signing, the signature becomes invalid. Some modifications are allowed in specific fields, such as adding another signature or filling a form, depending on how the signature was created and the permissions set. A change to the signed content breaks the signature.
A cryptographic signature is not automatically a qualified signature. It can be an advanced electronic signature, a qualified electronic signature or an enterprise signature, depending on the certificate and the process. The legal effect depends on the jurisdiction and the document type.
The qualified electronic signature
In the European Union, eIDAS defines simple, advanced and qualified electronic signatures. A qualified electronic signature is created by a qualified electronic signature creation device and is based on a qualified certificate for electronic signatures. It has a specific legal effect: it is treated as equivalent to a handwritten signature in many contexts.
Qualified signatures are often used through a trust service provider, a smart card, a USB token or a remote signing service. The signer authenticates, the provider applies the signature, and the result includes a certificate and often a timestamp.
In the United States, ESIGN and UETA give electronic signatures broad validity, with exceptions such as wills, some family law documents and certain notices. A qualified signature under eIDAS is not a concept in US law, but a certificate-based signature can still provide strong evidence of integrity and identity.
Other countries have their own trust frameworks. A signature that is qualified in one country may not be recognised as qualified in another. If the recipient specifies a legal regime, follow it.
What a reader can and cannot tell
A reader can verify the cryptographic integrity of a signed document if it trusts the certificate chain. It can show that the document has not changed since the signature was applied. It can show the signer’s name as it appears in the certificate, which may or may not be the person you think it is.
A reader cannot tell whether the signer had the authority to sign, whether the signer understood the document, or whether the signature was obtained under duress. Those are legal and factual questions, not cryptographic ones.
A visual signature has no cryptographic integrity. A reader can see the image, but it cannot prove that the image was placed by the person named, or that the document was not changed afterward. A screenshot of a signed page is even weaker; it is an image of an image.
Timestamps and long-term validation
A signature can include a timestamp from a trusted time-stamping authority. The timestamp proves that the signature existed at a certain time, which matters if the certificate later expires or is revoked.
Long-term validation (LTV) adds information to the PDF so that the signature can still be verified years later, even if the certificate chain or the timestamp service changes. LTV is important for contracts that must remain verifiable for a long time.
Not every signature includes a timestamp or LTV. If the document is a long-term record, ask the provider whether the signature is PAdES-LTV or equivalent, and how the validation data is preserved.
Signature fields and multiple signers
A PDF can contain signature fields. A field may be empty, or it may contain a signature. A document can require several signatures in a specific order. Some workflows use a certification signature that locks the document after signing; others allow additional signatures.
A visual signature placed on a page does not fill a signature field. If a form has a signature field, a PDF reader may still show it as unsigned even though an image is placed over it. If the recipient’s system checks the field, the document may be rejected.
For multiple signers, use a workflow that creates a separate signature field for each person. A single visual signature at the bottom of the page does not prove who signed or when.
What OpenToola does and does not do
OpenToola’s Sign PDF tool adds a visual signature to the page. It does not create a certificate, does not use a private key, does not add a timestamp and does not fill a cryptographic signature field. It is a practical tool for documents that need a visible signature, not a qualified signing service.
The PDF stays in the browser. The signature is embedded as an image. The file is not uploaded and no account is created.
If a recipient requires a cryptographic or qualified signature, use the provider or portal they specify. Do not place a visual signature and describe it as a digital signature; that can be misleading and may cause the document to be rejected. If the requirement is unclear, ask the recipient in writing and keep the answer with the file.
When a visual signature is enough
A visual signature is often enough for internal documents, informal contracts, delivery notes, approvals and forms where the recipient only needs a visible mark. It is also enough when both parties have agreed to use a simple electronic signature and there is no legal requirement for a qualified one.
It is not enough when a law, a court, a notary, a bank or a public portal requires a qualified or certified signature. It is also weak evidence if the document is disputed and the other side claims the signature was copied or the file was altered.
How to verify a signed PDF
Open the PDF in a reader that supports signatures, such as Adobe Acrobat Reader. Look for the signature panel or the signature properties. A valid signature should show the signer, the signing time and the certificate status.
Check whether the document has been modified after signing. A reader may show “signature is valid” but also “document has been modified”; read both messages and check the certificate status. Check the certificate issuer and whether it is trusted by your organisation.
If the reader shows a yellow warning or an unknown certificate, do not assume the signature is valid. Ask the signer for the certificate chain or use the validation service specified by the sender. Keep the original signed file; printing and rescanning destroys the cryptographic signature.
Privacy and practical choices
A qualified signature often involves a trust service provider, which processes identity data and signing metadata. Read the provider’s privacy policy. A visual signature in a browser tool keeps the file local, but it does not provide the legal assurance of a qualified signature.
Choose the tool by the requirement, not by the word “signature”. If the requirement is “a visible signature”, a visual tool is fine. If the requirement is “a qualified electronic signature”, use a qualified provider.
Tools mentioned
Frequently asked questions
Is a drawn signature on a PDF a digital signature?
No. A drawn signature is a visual mark. A digital signature uses a certificate and cryptography to bind the signer and the document content.
Does a digital signature make a document legally valid?
It depends on the jurisdiction, the document and the type of signature. A qualified electronic signature has a specific legal status in the EU; other countries have their own rules.
Can OpenToola create a cryptographic signature?
No. The Sign PDF tool adds a visual signature. For a certificate-based signature, use a qualified trust service provider or the portal required by the recipient.