Guide
PAdES and eIDAS PDF Signatures Explained
Last updated October 6, 2026
"Is this PDF signature valid?" is two questions wearing one coat. The first is mathematical: does the signature match this exact document? The second is about trust and law: who signed, with what kind of signature, and does the law give it weight? A browser tool can answer the first well. The second needs trust services and context. This guide separates them.
What a digital signature in a PDF is
A signature in a PDF is a block of data created with the signer's private key over a hash of most of the file (the "byte range"). It carries the signer's certificate, and may carry more certificates, a time stamp and information for later validation. If a single signed byte changes, the hash no longer matches and the signature fails. Bytes added after the signed range, such as a later signature or a timestamp, are allowed to exist; whether a particular later change is permitted is a separate question.
Integrity versus trust
Integrity means the document is the one that was signed. Checking it needs only the file: recompute the hash, verify the signature value with the certificate inside. The PAdES PDF Signature Inspector does this in your browser.
Trust means you have reason to believe the certificate belongs to the person or organisation it names. That needs the chain of certificates up to a trusted authority and the status of each at the time of signing (not revoked, not expired). A self-signed certificate is intact and untrusted: nobody but its owner vouches for it.
The eIDAS levels
The EU regulation on electronic identification and trust services (eIDAS, Regulation (EU) No 910/2014) distinguishes simple, advanced and qualified electronic signatures. In outline: an advanced signature is uniquely linked to the signer, can identify them and is under their sole control; a qualified signature is an advanced one created with a qualified signature creation device and based on a qualified certificate. A qualified signature has the equivalent legal effect of a handwritten signature. Which level a signature has is established by validating it against the EU trusted lists, not by reading a label inside the file. A certificate may contain statements claiming that it is qualified; those are claims, and a validation against the trusted lists confirms or refutes them.
PAdES and its levels
PAdES, defined by ETSI (EN 319 142-1), is the profile family for PDF signatures. The baseline levels build on each other:
| Level | Adds |
|---|---|
| B-B | The basic signature with the signing-certificate reference. |
| B-T | A trusted time stamp proving the signature existed at that time. |
| B-LT | Long-term validation data (certificates and revocation information) stored in the document security store (DSS). |
| B-LTA | A document timestamp that protects the validation data for archiving. |
Seeing the building blocks of a level in a file tells you what the signer intended; it does not prove conformance.
What a browser inspection can and cannot do
- It can check byte range, digest and signature value; list the signer, issuer, validity dates, key and embedded chain; read timestamps and DSS content; flag weak digests (SHA-1) and self-signed signers.
- It cannot consult the EU trusted lists, decide whether a certificate is qualified, query OCSP or CRL services, or judge whether changes after signing are allowed.
The European Commission publishes DSS, an open-source Java library with a demonstration web application that can evaluate trust against the trusted lists. National validation services exist too. For anything with legal weight, use one of them; use a quick integrity check to spot a modified file or to see what a signature contains.
Before you sign or send
Add everything you need to a PDF before it is signed: page numbers, a QR code (the Add GiroCode to PDF Invoice tool warns when a PDF is signed) or a stamp. For a wider routine, see How to check a PDF before sharing it.