How Digital Signatures Work: Hashes, Keys and Certificate Chains

Most of what people call signing a PDF is drawing a picture of a name on a page. That is a visible mark, and for plenty of everyday agreements it is exactly what the parties expect. A cryptographic digital signature is a different mechanism entirely. It does not try to look like handwriting; it attaches mathematical evidence that a specific document, byte for byte, was approved by the holder of a specific private key at a specific time. The value it provides is integrity and identity, not appearance, and confusing the two is a common and expensive mistake.

The first ingredient is a cryptographic hash function. Feed it any amount of data and it produces a short fixed-length fingerprint, with two useful properties: you cannot work backwards from the fingerprint to the data, and changing even a single bit of the input produces a completely different output. That avalanche behaviour is what makes a hash a reliable stand-in for the whole document. Rather than signing megabytes, the signer signs the fingerprint, and any later comparison of fingerprints answers the only question that matters: is this still exactly the same content?

The second ingredient is public key cryptography. The signer holds a private key that never leaves their control and publishes a matching public key. Signing transforms the hash using the private key in a way that anybody with the public key can verify but nobody without the private key can produce. That proves the signature came from the key, though not yet from a person. Bridging that gap is the job of a certificate: a trusted authority vouches that this public key belongs to a named individual or organisation, and its own certificate is vouched for in turn, forming a chain up to a root your software already trusts.

In a PDF, the signature object records a byte range covering the whole file except the slot where the signature value itself is stored, plus the hash and the certificate chain. A verifying reader recomputes the hash over those same bytes and compares. Alter one character of text, one pixel of an image, or even resave the file through a tool that rewrites the structure, and the recomputed hash no longer matches, so the reader reports that the document has changed since signing. The format does allow certain later additions through incremental updates when the signer permitted them, which is how a second approval or a form entry can be added without destroying the first signature.

So here is the honest practical distinction. The sign tool on PdfWill lets you place a drawn or typed signature onto a page, in your browser, without your contract touching a server, and that is the right tool for internal approvals, delivery notes, forms and the many documents where a visible mark is what is being asked for. It is not a certificate-based signature, and PdfWill does not run multi-party signing workflows. When a document genuinely requires cryptographic proof of identity and tamper evidence, you need a certificate issued by a recognised authority and a service built around that trust chain.