Pyrbit
PDFMost people meet PDF signatures in two situations. One is everyday paperwork: a rent agreement draft, a consent form from a school, an offer letter to accept. The other is formal filing: income tax, company records, GST, tenders. The word “signature” is used for both, but the technology behind them is completely different, and mixing them up is the most common reason a signed document gets rejected.
Two kinds of signature
A drawn, typed or image signature is a picture
When you draw your signature with a finger or mouse, type your name in a handwriting-style font, or place a photo of your signature on the page, the PDF simply gets a small image at that spot. It looks like a signature on paper, and for many purposes that is all anyone needs. But the file itself has no idea who added the image. Anyone who has a copy of the picture can paste it onto another document, and nothing in the PDF will show the difference.
A digital signature is a cryptographic seal
A digital signature does not have to be visible at all. When you sign, software calculates a fingerprint (a “hash”) of the document’s contents and locks that fingerprint with a private key that only you hold. Your certificate, issued by a certifying authority after checking your identity, travels with the signature. Anyone who opens the file can then check two things: that the document has not changed since it was signed, and who the certificate belongs to. Change a single character after signing and the check fails.
Many digital signatures also place a visible box on the page (“Digitally signed by …, Date …”), but that box is just a label. The proof is in the hidden signature data, not in what you see.
Which one is accepted where
There is no single rule, so always follow what the person or office asking for the signature says. As a general guide:
| Situation | What is usually expected |
|---|---|
| Accepting an offer letter, school or college forms, internal approvals, simple declarations sent by email | A drawn or image signature is usually fine. |
| Agreements between individuals or small businesses | Often a drawn signature; some parties prefer Aadhaar eSign for a stronger record. |
| Company filings, GST, certain tax forms, government e-tenders | A digital signature certificate (DSC) or a specified electronic signature method. |
| Documents that must be printed and stamped | A wet signature on paper; a scanned copy may be accepted for submission. |
If a form says “digitally signed”, a picture of your signature will not satisfy it, however neat it looks.
Digital signatures in India: DSC and Aadhaar eSign
India’s Information Technology Act, 2000 gives legal recognition to electronic signatures, and certificates are issued by certifying authorities licensed by the Controller of Certifying Authorities (CCA). You will meet two main forms.
Digital Signature Certificate (DSC)
A DSC is a certificate issued to you after identity verification, typically used by professionals, company directors and businesses for regulatory filings. Class 3 certificates are the kind commonly issued today. Most DSCs are delivered on a USB token, a small hardware device that holds the private key and is designed so the key cannot be copied out. You sign by plugging in the token and entering its PIN in the software the portal specifies. Some certificates are instead issued as a file with a .pfx or .p12 extension, protected by a password.
Aadhaar eSign
Aadhaar eSign is an online signing service offered through licensed eSign service providers. You authenticate with an OTP sent to your Aadhaar-linked mobile number, a short-lived certificate is issued in your name, and the document is signed with it. It is convenient for one-off signatures because you do not need a token, but you sign through the provider’s website or app, not by uploading a signature image.
The e-Aadhaar letter itself is signed
The e-Aadhaar PDF you download from UIDAI carries a digital signature. Many PDF readers show it as “validity unknown” because they do not include the CCA India root certificate in their trust list. That does not mean the document is fake; it means the reader cannot complete the check on its own.
How to add a drawn or typed signature
For everyday documents, a visible signature is quick to add. With Pyrbit’s Sign PDF in your browser:
- Open the PDF. If it has form fields, fill those in first so you sign the final version.
- Create your signature. Choose Draw to sign with a mouse, finger or stylus, Type to use your name in a handwriting font, or Image to use a photo of your signature. Signatures you make are kept under Saved for next time.
- Place and size it. Click where the signature belongs and drag the corners so it sits naturally on the line, not overlapping printed text.
- Add the date if needed using the text option, then save the signed PDF.
For a photographed signature, sign with a dark pen on plain white paper, photograph it in daylight without shadows, and crop it closely. It will look far more natural than a mouse-drawn scribble.
How to apply a digital signature
If your certificate is on a USB token, use the software your certifying authority or the filing portal provides, because the key cannot leave the token. If you have a .pfx or .p12 certificate file, Pyrbit’s Aadhaar Digital Signature tool can sign with it: choose the certificate, enter its password, and the signature is added to the PDF on your device. A self-signed certificate (one you create yourself) will show as “validity unknown” to other people, because no recognised authority vouches for it.
How to verify a signed PDF
Whenever you receive a document that claims to be digitally signed, check it rather than trusting the stamp on the page:
- Open the file in a tool that validates signatures, such as Verify PDF Signature, which includes the CCA India root certificates so Indian DSC and e-Aadhaar signatures can be checked.
- Look at the overall status. Valid means the document is unchanged and the certificate chains to a trusted root. Validity unknown means the document is intact but the signer’s certificate could not be traced to a root the tool trusts. Invalid means the document was changed after signing or the signature is broken.
- Read who signed it and when, and whether the tool reports changes after the last signature.
If a PDF shows a signature box but the checker finds no digital signature at all, that box is only a picture.
Why editing a signed PDF breaks the signature
The signature protects the exact bytes of the document at the moment of signing. Adding a comment, filling a field, compressing the file, rotating a page or even re-saving it in some editors changes those bytes. A validator will then report that the document was modified after signing, or that the signature is invalid. This is the system working as intended: it is what makes a digital signature trustworthy.
So the order matters:
- Finish all edits, form filling and compression.
- If needed, use Flatten PDF so fields and annotations become part of the page.
- Apply the digital signature last.
- Send the signed file as it is. Do not open and re-save it before sending.
When several people need to sign, each signature is added as an update on top of the previous one, so earlier signatures remain valid. That only works if nobody changes the content between signatures.