PDF Signer

No identity

Identity settings

Signature image

No image for this identity

Photograph or scan on white paper — the background is removed automatically.

GitHub vault

Not configured yet.

On sign, your identity's certificate is auto-published to <vault>/certs/<fingerprint>.pem once, and each signed PDF carries the raw URL. Verifiers auto-fetch it and trust the signer transitively via the vault's HTTPS chain — no manual trust setup on the recipient's side. Signed PDFs are also AES-encrypted and pushed as .vault files if the integrity stamp is enabled.

Trusted roots

Roots the verifier trusts when checking cert chains. Automatically populated: creating an identity self-trusts its own cert, importing a p12 with a chain trusts the chain's root, and clicking "Trust current identity's root" below trusts whatever's active. Manual PEM paste is only needed for third-party CAs (a colleague's cert, an experimental root).

No trusted roots configured yet — create or import an identity to auto-populate.

PDF normalization ⓘ

Auto-normalize source PDFs when needed (recommended)

On open, detects two Adobe-tripping markers in the source: a legacy /Version /X.Y pin in the catalog, or a fragmented xref with multiple subsections. If either is present, runs the source through Ghostscript's pdfwrite+PDF/A-2b pass BEFORE signing to produce a clean, contiguous, Adobe-friendly structure. Fixes the "document has been modified" rejection Adobe throws on Office/Word-generated PDFs (Ayush.pdf-style sources) while other validators say the signature is fine. When the source already looks clean (most machine-generated PDFs), Ghostscript is never loaded — the detection is cheap and the CDN pull only happens on documents that actually need it.

Ghostscript-WASM (~5 MB gzipped) is loaded on demand from jsDelivr the first time you sign a PDF that needs it — no local install. It's AGPL-3.0, upstream Artifex build, unmodified; pdf-signer itself stays MIT. Turn off if you don't want the runtime CDN dependency.

Trusted timestamp (RFC 3161) · on by default

Countersign with a TSA ⓘ TSA URL

Default rfc3161.ai.moda is one of the few public TSAs that sends CORS headers, so it works from a browser. Most other public TSAs (freeTSA, DigiCert, Sectigo) reject browser fetches; a failure toast will name the URL that refused. Adobe silent-green requires a TSA on Adobe's own trust list — none of the free ones qualify. Auto-suppressed when "Sign as of" carries a backdate — only one time claim is written to the signature at a time.

Placements

Stamp every page with QR + verification code ⓘ · off

Signer role (optional) Vault hosting

Auto-upload to your GitHub repo Local .vault file only

GitHub vault: not configured yet.

Also download a local .vault copy

Pick a tool from the floating bar above the page, click to drop it. Drag to move, corner to resize, × or Delete to remove, Ctrl/⌘+Z to undo.

Signature appearance

Stamp (QR seal · digitally signed by · date · reason) Text (name · date · reason · location) Image only (your signature PNG) Image + text

Name font Reason Location (optional) Sign as of (blank = now — set to backdate) After signing

No certification ⓘ Lock document ⓘ Certify, allow further signatures ⓘ

100%

A ▨

🔒 This PDF is password-protected. You can view and verify it, but signing or redacting encrypted PDFs isn't supported yet — save an unencrypted copy first (in Preview: File → Export as PDF, uncheck the encryption box; or in another tool).

📄

Open, sign or verify a PDF

Everything runs in your browser. Nothing is uploaded.

…or drop a PDF anywhere on this area

Pages