How to digitally sign a PDF with PDF by Zaweba
Sign a PDF in a box, invisibly or in a signature field using a .pfx file, a Windows certificate or a self-signed ID, with PAdES or PKCS #7 signatures.
A picture of your handwriting pasted onto a page shows that someone put it there. A digital signature goes further: it proves who signed and shows whether the document has changed since. PDF by Zaweba makes real digital signatures from the Sign menu, offline, using a digital ID you already have or one you make in the app.
Where the signature goes
You have three choices. You can sign in a box you draw on the page, which gives a visible signature wherever you want it. You can sign invisibly, which adds the signature to the document without anything on the page, useful for files where the look must not change. Or you can sign in a signature field, the natural choice when a form has a place set aside for it.
Visible signatures reassure readers who expect to see something. Invisible ones are just as valid, and the signatures panel shows them either way.
Which digital ID to use
A digital ID is a certificate and its private key. PDF by Zaweba can use three kinds.
A .pfx or .p12 file is the common way IDs are handed out by organisations and certificate providers. Choose the file and enter its password.
A certificate in the Windows store is one already installed on your PC, perhaps by your employer. If it's there, you can pick it without hunting for files.
A self-signed ID made in the app is the quickest to get started with. It proves the document hasn't changed since you signed, and it identifies you to anyone who chooses to trust your certificate. Export my certificate saves your public certificate as a .cer or .pem file, so you can send it to the people who need to check your signatures, and they can add it to their trusted certificates.
What kind of signature is made
Signatures are made as PAdES or PKCS #7, with SHA-256, 384 or 512. PAdES is the modern standard for PDF signatures and the better choice for most people. PKCS #7 is the older form, still widely read. The SHA numbers are the strength of the fingerprint taken of the document. Any of the three is strong. SHA-256 is the most widely understood.
Why earlier signatures stay valid
Signatures are added as incremental updates. The document as it stood is left untouched and the new signature is added after it. So when a contract passes through several people, each signature covers its own version and the earlier ones stay valid. That's what lets a document collect signatures from a buyer, a seller and a witness, one after another.
It also means you should finish every change before you sign. Anything done afterwards shows as a change made after your signature.
Before you sign
Use Preview the document for signing first. It lists dynamic content, such as scripts, XFA, automatic actions, media and layers, that could make the document look different from one reader to another. PDF by Zaweba never runs scripts or media and shows the static document, so what you see is what you sign.
Going further
For documents that must stay checkable for years, add a timestamp from a timestamp server and long-term validation information. For the first signature on a document you control, consider certifying instead of plainly signing, which lets you decide what may change afterwards. And when signed documents come back to you, the signatures panel checks each one.
So the clean routine is this. Finish editing. Preview for signing. Sign, choosing the right ID and placing the signature where it belongs. Save. Open the signatures panel and confirm it reads as valid. Then send. All of it happens in PDF by Zaweba without uploading the document or your ID anywhere.
