What is PAdES?
PAdES is a standard for putting digital signatures inside a PDF, so anyone can check that the file hasn't changed. It proves the file is intact since a moment in time. It doesn't prove who a person is, and people mix those up all the time.
By docuinked. Published 2026-11-07, updated 2026-11-07.
A seal is not a signature, in the plain sense
Two things share the word "signature". An electronic signature is a person agreeing, which is a legal idea. A digital signature is maths over the bytes of a file, which is a technical idea. PAdES is the second kind. In docuinked, the people sign on the signing page, and one seal goes on the finished file to protect it.
The levels
PAdES has baseline levels defined in ETSI EN 319 142-1. Each adds something.
| Level | Adds | Effect |
|---|---|---|
| B-B | A signature and signing certificate | Depends on that certificate still being valid |
| B-T | A trusted timestamp | Proves the file existed at that time |
| B-LT | Certificates and revocation data in the file | Can be checked from the file alone |
| B-LTA | A document timestamp over all of it | Can stay checkable as certificates and algorithms age |
Why the timestamp matters
Without one, the only clock is the signer's own, and a person can set their own clock. An outside timestamp authority signs the hash with its own time, using RFC 3161. A timestamp from before a key was compromised can still stand after it is revoked.
What docuinked does today
We apply a PAdES signature over the finished file, with a timestamp from an outside authority. That is the B-T level. We don't yet embed the full validation data for B-LT, and we are open about that. Our seal certificate is our own, not one on the Adobe trust list, so Acrobat reports the signer as unknown unless you trust our certificate. The file's integrity check still works.
What a seal doesn't prove
A seal says "this file hasn't changed since we sealed it". It says nothing by itself about who signed. Identity lives in the evidence: which address got the link, what steps were passed, what device was used. Be wary of anyone who sells a PDF seal as proof of identity.
Sources
Checked 2026-11-07.
- Idura on PAdES levels
- PDF Tools on PAdES
- Adobe on validating digital signatures
- Adobe Approved Trust List
Common questions
Why does Adobe say the signer's identity is unknown?
Acrobat trusts certificates that chain to its approved list. Ours doesn't yet. That message is about our certificate's status, and it doesn't mean the file was changed. Acrobat's check on the file itself still runs.
Does a PAdES seal make a contract valid?
No. A contract stands on agreement and intent. The seal only protects the file against later change, which helps you show it is the same document.
Is one seal enough for a document with many signers?
Yes, for integrity. Sealing once at the end also avoids a known issue where a PDF reader flags earlier signatures after later ones are added.
Related
Try it in test mode
Free during the beta. Test keys send no email, so you can build the whole flow first.