signature

A signature on a PDF is a seal inside the document that proves who approved it, and that not one byte has changed since.

In more detail

It is not a picture of a handwritten name. A picture proves nothing: anybody can paste one in.

A signature is a number worked out from all of the file except the place the seal itself sits in, using a private key that one person or one company holds. Anybody can check it with the matching public key, the one everybody is allowed to see, and nobody can produce it without the private one. Change a single character in the document and the check fails.

What it does on a real document

The seal covers the whole file except the small hole its own value sits in. Reading software opening the document reads everything on both sides of that hole, works the number out again, and compares the two.

This is also why a sealed document can be added to without breaking the seal: what is added is written after the sealed part, and reading software shows the document as it was approved and says what came afterwards. The engine leaves the hole and writes the file around it; your private key never leaves your own machine.

Where it comes from, and why

The idea is older than the format. A way of proving who wrote a message, without the two sides ever having met and without a shared secret, was published in the 1970s, and everything since rests on it.

PDF gained a place to put such a seal early on, and Europe has since written the rules for what one has to use to stand up in law. The seal alone is only half of it: the other half is the certificate saying that the signing key really belongs to whoever claims it.

See it on a finished document

The page that goes further on this word

Back to the whole glossary