Question 1

What is the difference between this and the Sign PDF tool?

Accepted Answer

Sign PDF draws a picture of your signature — a visual mark, like printing, signing and scanning. This tool signs cryptographically: it reads your certificate, builds a PAdES (adbe.pkcs7.detached) signature and seals the document bytes with it. Anyone can then verify with Verify PDF signatures that the file has not changed since you signed it.

Question 2

Where does my certificate and password go?

Accepted Answer

Nowhere. The .pfx/.p12 file is held in this tab's memory and handed to the worker thread on your device by structured clone — the same origin, no network. The password is used to decrypt the key in that worker and is never stored: close the tab and both are gone. Nothing is uploaded to any server.

Question 3

Why does the verification report call my self-signed certificate "attention"?

Accepted Answer

Because that is the honest verdict. A self-signed certificate proves the document has not changed since you signed it, but it does not prove WHO signed it — anyone can mint one. The signature itself verifies as intact and cryptographically correct; the amber flag is about identity, not integrity. Certificates from a real CA (your company's, or a bought one) verify green.

Question 4

My .p12 is from an old Windows export — will it work?

Accepted Answer

Very likely yes. Old exports and OpenSSL ≤2.x "legacy" packs encrypt the key with 3DES and the certificates with 40-bit RC2 — the parser carries pure-TypeScript implementations of both, plus the modern PBES2 (PBKDF2 + AES-128/192/256) packs from current tools. ECDSA and EdDSA keys are honestly refused: the CMS builder speaks RSA.

Digital signature

How it works

Frequently asked