Signing a PDF: inserting a legally valid digital signature

Key points at a glance: A PDF can be signed at three legally distinct levels: simple, advanced or qualified. For most business documents, an advanced electronic signature (AES) – generated by a signotec signature pad in conjunction with the signoSign/2 software – is sufficient. A qualified electronic signature (QES) is only mandatory where the law requires the document to be in writing.

The term ‘signing a PDF’ can mean a wide variety of things: from a scanned signature to a certificate-based signature. The eIDAS Regulation distinguishes between three levels in this regard. A simple electronic signature (EES) is any digital mark that can be attributed to a person, such as an inserted image of a signature. It has the lowest level of evidential value. The advanced electronic signature (AES) uniquely attributes the signature to a person by recording biometric characteristics such as pressure, writing speed, time and acceleration. It is not biometrics that ensures subsequent alterations to the document are detectable, but rather the certificate-based, cryptographic signature with which the software seals the PDF. The qualified electronic signature (QES) uses the same principle, but additionally requires a certificate from a qualified trust service provider — the key difference from the FES, whose certificate does not have to come from such a provider. The QES is the only form that carries a legal presumption of authenticity: in the event of a dispute, the signature is initially deemed genuine, meaning the opposing party would have to prove otherwise.

A brief note on terminology: ‘digital signature’ refers technically to a cryptographic process, whilst ‘electronic signature’ refers to the legal term as defined by eIDAS. In everyday language, the two terms are usually used interchangeably — in this article, we follow common usage and use the term to refer to the electronic signature in the legal sense.

A PDF can be digitally signed in just a few steps – most reliably using signature software and a signature pad. This guide outlines the three most common methods and what beginners should bear in mind. The legal validity of the signature depends on the chosen signature level; for most documents, an advanced electronic signature (AES) is sufficient.

First things first: what you need for digital signing

For a simple signature, all you need is a PDF programme that allows you to insert a signature image. For a legally valid signature, however, you’ll need signature software and, ideally, a signature pad that captures your signature biometrically. This distinction is important: an inserted image is, legally speaking, merely a simple electronic signature with limited evidential value, whereas biometric capture produces a robust advanced electronic signature.

Method 1 – Signing a PDF with a signature pad

The most direct method for businesses is to use a signature pad:

1. Open the PDF in the signoSign/2 signature software.
2. Select the location in the document where you wish to sign.
3. Sign on the connected signature pad – the software automatically captures the biometric features.
4. The software encrypts the captured biometric data and embeds it securely in the PDF, together with a cryptographic signature, making it tamper-proof.

The process takes just a few seconds and generates an advanced electronic signature.

Method 2 – Signing a PDF on a tablet or touchscreen

If you do not have a signature pad to hand, you can also sign on a mobile device or touchscreen. The process is the same: open the document in the software, select the signature field, sign on the screen, and the signature is embedded. It is important that suitable software records the dynamic characteristics in the background – only then is an advanced electronic signature (AES) created, rather than merely an image of the signature.

Method 3 – Signing a PDF in a browser (remotely)

If the signatory is not on site, remote signing is a suitable option. Via signoSign/Universal, the signatory receives a link and signs the PDF directly in the browser. To ensure a qualified electronic signature, the software also integrates a qualified trust service provider that carries out prior identity verification. This allows transactions to be conducted in a legally compliant manner regardless of location.

The choice of device depends on the specific use case. At a desk, a signotec signature pad connected to the PC via USB is often sufficient. When out in the field or at the point of sale, customers sign directly on a mobile device, whilst the employee manages the process on a laptop. For processes that take place entirely remotely, the signature can be integrated via signoSign/Universal as a remote signature, whereby the signing takes place via a link in the browser. In all cases, the level of security remains the same, provided the same software and encryption are running in the background.

Yes, provided that the correct signature level has been selected for the relevant document type. Most contracts in day-to-day business, such as supply contracts or the majority of service agreements, are not subject to any specific formal requirements and can be signed in a legally valid manner using an FES. A QES, on the other hand, is mandatory where the law requires the written form but permits electronic signing — for example, in the case of consumer loan agreements under Section 492 of the German Civil Code (BGB) or fixed-term employment contracts under Section 14(4) of the Part-Time and Fixed-Term Employment Act. For fixed-term tenancy agreements lasting more than one year, the written form applies under Section 550 of the German Civil Code (BGB). In a few cases, the electronic form is entirely excluded, such as in the case of guarantees provided by private individuals under Section 766, second sentence, of the German Civil Code (BGB); here, a signature on paper remains mandatory. The practical implication: before digitising a document type, check which level of certification is actually required, rather than resorting to the more complex QES as a precaution.

Common mistakes when signing PDFs

The most common mistake is to insert a scanned image of a signature into a PDF and regard this as sufficient. This method only achieves the level of a simple electronic signature and has little evidential value in the event of a dispute. A second mistake is the blanket use of the QES for all documents, which unnecessarily increases time and costs without offering any legal added value. A third mistake is the use of software without an audit trail, which means that subsequent changes to the document can no longer be fully traced.

Can I sign a PDF legally for free?

For a simple electronic signature, yes; for a legally compliant FES or QES, professional software or hardware such as a signature pad is usually required.

Is a scanned signature in a PDF sufficient?

Only for documents with no specific formal requirements and where the amount in dispute is low. Legally, it is regarded as a simple electronic signature with limited evidential value.

Which programme is suitable for signing PDFs?

Software such as signoSign/2 combines signature capture, encryption and an audit trail in a single step; for QES and remote signatures, signoSign/Universal is used.

Is a PDF file signed in a browser just as valid?

Yes, provided the underlying remote signature solution technically implements the same signature level as a local solution.

How can I tell if a PDF has been altered after signing?

A properly signed FES or QES makes subsequent alterations visible, as the cryptographic signature is bound to the original document content.

Signing a PDF can be done in just a few steps, but the level of signature chosen determines its legal validity. For most business processes, an advanced electronic signature using a signature pad or tablet is sufficient. signotec offers both hardware and software from a single source: signoSign/2 for local advanced electronic signature (FES) processes and signoSign/Universal for browser-based signatures, either on-site or remotely, with a qualified electronic signature available as an option.