# Digital signature

A digital signature is a cryptographic value computed over a file with a private key, so anyone with the matching public key can check that the file hasn't changed since it was signed.

## In plain words

A digital signature is maths, not a mark. Software takes a [hash](/glossary/hash) of the file, then signs that hash with a private key. Anyone can check the result with the public key, usually carried in a certificate. If even one byte of the file changes, the check fails.

That gives you two things. First, integrity: the file is the same one that was signed. Second, a link to whoever controls the key. It doesn't tell you, by itself, that a particular human read and agreed to the document.

## An example

Open a sealed PDF in a PDF reader and look at the signature panel. The reader recomputes the hash, checks it against the signed value and reports "document has not been modified". It then looks at the certificate and asks whether it trusts whoever issued it. Those are two separate answers, and readers show them separately.

## How it works in docuinked

docuinked uses a digital signature as a seal, not as the signers' signatures. People sign electronically on the signing page. After the last signer, docuinked applies one [PAdES](/glossary/pades) seal over the whole file, with a timestamp from an outside authority. One seal covers every signer.

Two honest limits. The seal is at the PAdES B-T level today, not B-LT. And our seal certificate is not on the Adobe trust list yet, so Acrobat says the signer's identity is unknown. The file check itself still runs and still reports changes. You can trust [our public certificate](/seal-certificate.pem) by hand, or check any file with the [free PDF checker](/tools/verify-pdf).

## Common confusions

**Digital is not "more legal".** In the US, an [electronic signature](/glossary/electronic-signature) doesn't need cryptography to count. A digital seal helps you show the file is unchanged. It doesn't decide whether someone agreed.

**A seal doesn't prove identity.** A certificate proves who controls a key. For a platform seal, that is the platform. Who the signer was lives in the [audit trail](/glossary/audit-trail).

**Per-signer certificates are a different product.** Some high-assurance schemes give each signer their own certificate after an identity check. That is the path to EU advanced and qualified signatures under [eIDAS](/glossary/eidas). docuinked doesn't offer it.

## Related terms

- [Tamper-evident](/glossary/tamper-evident)
- [RFC 3161 timestamp](/glossary/rfc-3161-timestamp)
- [Certificate of completion](/glossary/certificate-of-completion)

## Sources

Checked 2026-11-07.

- [Adobe on validating digital signatures](https://helpx.adobe.com/acrobat/desktop/e-sign-documents/manage-digital-signatures/validate-digital-sign.html)
- [Adobe Approved Trust List](https://helpx.adobe.com/acrobat/kb/approved-trust-list2.html)
- [PDF Tools on PAdES](https://www.pdf-tools.com/pdf-knowledge/pades-pdf-advanced-electronic-signature/)

## Common questions

### Do my signers need a certificate of their own?

No. In docuinked, signers sign on a web page with no certificate, key or software. The single digital seal goes on the finished file.

### What does a green tick or blue ribbon in a PDF reader mean?

It usually means the file is unchanged and the reader trusts the certificate's issuer. A missing tick can mean the issuer isn't on the reader's list, not that the file was altered.

### Can a digitally signed PDF still be edited?

It can be opened and changed, but the change breaks the signature check. That is the point. The edit isn't blocked, it is exposed.