Ask ten people what a "digital signature" is and you'll get two answers wearing the same name. The first is the one everyone pictures: a handwritten-looking mark on the signature line — an image of your name, placed on the page, looking official. The second is a mechanism most people have never actually seen: cryptography baked into the file itself, tied to a certificate, able to show whether the document has changed since the moment it was signed. They look similar in a PDF viewer and they do completely different jobs.
This guide is about telling those two apart — what each one is, what legal weight each can carry, what PDFlyHQ's Sign PDF tool actually adds (the visual kind, stated plainly), and how to check which kind a given file carries. For the practical walkthrough of signing itself, see How to Sign a PDF — this post is the concepts.
Two things people call a "digital signature"
A visible e-signature is a picture: your handwritten signature, drawn or uploaded or typed in a handwriting-style font, placed on the page like ink. Its meaning comes from intent. In most jurisdictions, electronic agreements are binding because the parties consented to be bound and the signature evidences that consent — not because the mark itself is hard to forge.
A cryptographic digital signature is math wearing a certificate. The signer holds a digital certificate — an identity vouched for by a certificate authority — and signing computes a fingerprint over the document's exact bytes, embedding it in the file alongside the certificate. From that moment, any change to the document is detectable, because the fingerprint no longer matches. It answers questions the visible mark can't: who signed, when, and whether anything moved afterwards.
Neither one is "the real one." They solve different problems, and picking the wrong one is how documents end up under-protected or absurdly over-signaled.
What a cryptographic signature actually does
The mechanism, in plain terms: the signing software reads the PDF's bytes, computes a cryptographic hash of them, and writes that hash into the file together with the signer's certificate and a timestamp. Verifying means recomputing the hash and comparing. Identical bytes: the document is exactly what was signed. Different bytes: something changed after signing, and the check says so.
One nuance of how PDFs work is worth knowing, because it confuses people the first time they meet it. A PDF can legitimately gain bytes after being signed — a counter-signature, filled form fields, an annotation. Each signature only vouches for the document exactly as it was when that signature was applied. So "bytes were appended after signing" isn't automatically an accusation of tampering — but it is a reason to look at what was appended.
Where do you get one? Not from a general-purpose PDF utility — cryptographic signing lives in dedicated e-signature services and certificate-based signing features of full editors. It's a specialist job with specialist infrastructure behind it.
What the visual kind is — and when it's enough
The visible signature's job is appearance and intent: making a document look signed by the right person, in settings where the trust already comes from context. Internal approvals, cover letters, acknowledgment pages, forms where "this came back signed" is the requirement — that world is enormous, and it runs perfectly well on visual signatures.
Its honesty is also its limit: a picture proves nothing technically — anyone with an image editor can move one. A wet-ink signature on a fax proved nothing technically either; the surrounding process did the proving. But that's why the two kinds must not be confused when the stakes are real: a mark that looks identical whether or not the document was altered cannot vouch for its contents.
What PDFlyHQ's Sign PDF tool actually does
Stated plainly, because the tool says so itself: Sign PDF adds a visual signature image to your PDF. That is the whole mechanism. You create the signature three ways — draw it with your mouse or finger, type your name in a handwritten-style font, or upload an image of your signature — then drag it into position and resize it with a slider. For multi-page documents, "Add to every page" places the signature in the same spot on every page, the pattern contracts use for initialing each sheet.
Just as plainly: it is not a certified, legally binding e-signature under eIDAS or the U.S. ESIGN Act, and there's no audit trail or certificate. For contracts that require legal certification, use a dedicated e-signature service. That disclosure isn't a defect — it's the difference between a tool that puts ink in a place and a service that builds evidence. Confusing them would be the one genuinely dangerous move available here.
What the tool does give you, beyond the signature itself, is locality: the unsigned contract is read, signed, and saved by the page you have open, never uploaded — for employment paperwork and medical forms, that's a real property, not a slogan.
How to check whether a PDF carries a cryptographic signature
The reverse question comes up just as often: you've received a "signed" PDF and want to know which kind of signature it carries. That's a checking job, and PDFlyHQ has a dedicated tool for it: PDF Signature Verifier. It reports whether the file has a digital signature, who signed it and when, the signature's format, its change permissions, and whether anything was added after signing.
Its honest limit, stated the same way the tool states it: it's a structural check. It can't validate the cryptographic chain of trust — certificate issuer, revocation status, trust anchors. For legal-grade validation, open the signature panel in Adobe Acrobat Reader.
One pairing worth making explicit: Sign PDF adds the visual kind; the verifier checks for the digital kind. Run the verifier on a file you signed with Sign PDF and it will correctly report there's no digital signature — because there isn't one. That's not an error; that's the concept split doing its job.
Which one does your document need?
The decision collapses to one question: does the signature need to look signed, or does it need to prove something?
- Look signed — internal documents, approvals, cover letters, forms inside a trusted flow: a visual signature is the right-size tool, and Sign PDF does it without an upload or an account.
- Prove something — regulated agreements, anything that might one day be disputed, documents where "was this altered?" must have a real answer: use a dedicated e-signature service or certificate-based signing.
- Somewhere between — sign visually for the flow, and add access control around the file itself; the walkthrough for that is How to Password-Protect a PDF.
When in doubt, ask the other party what standard the document requires — their answer picks the tool. This isn't legal advice; it's the same honesty the tools themselves are built around.