How to sign a PDF document online: the complete 2026 guide

Each year, billions of PDF documents are exchanged between businesses, public authorities and individuals. Yet many still don't realise that signing a PDF document is not a trivial action: the method chosen directly determines the legal value of the act, its admissibility in case of dispute and regulatory compliance with eIDAS. This 2026 guide explains step by step how to sign a PDF online, which tools to use, what level of signature to adopt depending on your context — and why certain common practices (scanned image, ticked box) expose your contracts to serious risks.

Different methods for signing a PDF document

Simple Electronic Signature (SES)

The most common method involves placing a simple electronic signature on a PDF file. It can take several forms: a validation click in a web interface, a ticked box, or even an image of a handwritten signature embedded in the document. This approach is quick and requires no in-depth identity verification.

Its use is suited to low-stakes acts: internal purchase orders, quotation validations, acknowledgements of receipt. However, its evidential value remains limited as it offers no guarantee of the signatory's true identity. By way of comparison, a scanned handwritten signature provides no greater legal security — and may even be more easily challenged than a properly executed SES.

Advanced Electronic Signature (AES)

The advanced signature meets stricter technical requirements, defined by the eIDAS regulation (Article 26): it must be uniquely linked to the signatory, enable their identification, be created from data under their exclusive control, and detect any subsequent modification of the document.

In practice, an AES on PDF relies on a digital certificate issued after identity verification (often by video or scan of an identity document), combined with a cryptographic algorithm that "seals" the file. If the PDF content is modified after signing, the signature becomes invalid — which constitutes a fundamental integrity mechanism. AES is the recommended solution for the vast majority of commercial contracts, employment contracts and HR documents. HR-specific solutions systematically integrate this level of signature for dematerialised payslips and amendments.

Qualified Electronic Signature (QES)

At the top of the eIDAS hierarchy, the qualified signature is created using a qualified signature creation device (QSCD) and is based on a qualified certificate issued by a qualified trust service provider (QTSP), listed on the European Trusted Lists. It has, under Union law, the same legal value as a handwritten signature — without the need to demonstrate its authenticity afterwards.

Its use is reserved for high-stakes acts: public contracts, dematerialised notarial deeds, certain corporate law acts. Its deployment involves a reinforced enrolment procedure (face-to-face or qualified remote identity verification). To understand the complete technical and regulatory implications, consult our guide on eIDAS 2.0 regulation.

How to sign a PDF online: practical steps

Choosing the right signature platform

The market offers numerous solutions: DocuSign, Adobe Acrobat Sign, YouSign, Certyneo, and others. To choose, several criteria are decisive:

• Signature level supported: not all platforms offer QES;

• eIDAS and GDPR compliance: data must be hosted or processed according to European protection rules;

• API integration: essential for high volumes or automation;

• Audit trail: each signature must be accompanied by a timestamped and tamper-proof log.

Our comparison of electronic signature solutions details these criteria to help you choose with full knowledge of the facts.

Preparing and sending the PDF document

• Check the source PDF: ensure it is not write-protected and does not contain conflicting form fields.

• Define signature areas: most platforms allow you to drag and drop "signature fields" to precise locations in the document.

• Identify signatories: enter the email, name and, depending on the level required, telephone number for OTP.

• Configure the signing order: sequential (signatory B receives after A) or parallel (all notified simultaneously).

• Send and track: a secure link is sent to each signatory; the platform notifies the sender at each stage.

Verify and archive the signed document

Once all signatories have affixed their signatures, the platform generates a signed PDF containing integrated cryptographic signatures and, in most cases, a completion certificate (audit trail). This file must be kept under conditions guaranteeing its integrity over time.

Electronic timestamping plays a key role here: it certifies the exact date and time of the signature, which can be decisive in case of dispute. Solutions compliant with ETSI EN 319 132 integrate this timestamping automatically into the PDF file (PAdES format — PDF Advanced Electronic Signatures).

Technical formats for PDF signatures

PAdES, CAdES, XAdES: what are the differences?

The PAdES format (PDF Advanced Electronic Signatures) is the European standard for signing PDF files. It integrates the signature directly into the file, making the document self-contained: it is not necessary to have a separate signature file to verify its validity. PAdES is defined by the ETSI EN 319 132 standard and is the format recommended by ANSSI for PDF signatures.

The CAdES (for binary files) and XAdES (for XML files) formats apply to other types of documents. In a PDF context, PAdES is always preferred.

Compliance profiles: B, T, LT, LTA

PAdES comes in several compliance profiles, from the simplest to the most robust:

• PAdES-B: basic signature, without timestamping;

• PAdES-T: includes a timestamp token;

• PAdES-LT: embeds revocation information (OCSP/CRL), allowing deferred validation;

• PAdES-LTA: adds an archive timestamp to guarantee validity over the long term (recommended for retention > 10 years).

For contracts with long duration — commercial leases, framework contracts, multi-year confidentiality agreements — the LTA profile is highly recommended, as it allows signature validation even after the original certificate expires.

Security, traceability and best practices

The audit trail: essential proof in case of dispute

An electronic signature without an audit trail is a signature that is difficult to defend before a court. The audit trail records all events related to the signature: document sending, opening by the signatory, IP address, timestamp, authentication method, OTP code used, etc.

This log constitutes a standalone element of proof, distinct from the signed PDF itself. In case of dispute, it makes it possible to reconstruct the exact chronology and demonstrate that the signature was indeed issued voluntarily by the identified person. Platforms compliant with eIDAS retain this data for the legally required duration.

Signatory authentication: the central issue

The strength of an electronic signature rests primarily on the robustness of signatory identification. Several methods are distinguished:

• OTP code by SMS: basic level, sufficient for SES;

• Identity document verification by AI: required for AES in many contexts;

• Live video verification: standard for qualified certificates;

• Private key on smart card or USB token: reserved for professionals using QSCDs.

Electronic signature in business often involves combining multiple methods depending on signatory profiles: internal signatories (known employees) vs. external signatories (customers, partners, service providers).

GDPR and personal data of signatories

The collection of email addresses, telephone numbers and identity document copies as part of a signing procedure constitutes processing of personal data under the GDPR (Regulation No 2016/679). The signature platform acts as a processor; it must provide a compliant DPA (Data Processing Agreement). Data must be deleted or anonymised at the end of the contractual retention period. Systematically verify server location: hosting outside the EEA without adequate safeguards exposes the company to CNIL sanctions.

Applicable legal framework for signing PDF documents

Electronic signature of PDF documents falls within a legal framework at several levels, articulating European law and national law.

French civil law. Article 1366 of the Civil Code provides that "an electronic writing has the same probative force as a writing on paper, provided that the person from whom it emanates can be duly identified and that it is drawn up and kept under conditions such as to guarantee its integrity". Article 1367 clarifies that electronic signature consists of "the use of a reliable identification process guaranteeing its connection with the act to which it is attached". These provisions form the basis of the legal admissibility of PDF signatures in French law.

eIDAS Regulation No 910/2014. This European regulation establishes three levels of signature (simple, advanced, qualified) and establishes the principle of non-discrimination: no electronic signature may be rejected solely on the ground that it is in electronic form. The qualified signature benefits from a legal presumption of equivalence with a handwritten signature (Article 25, §2). The eIDAS 2.0 Regulation (Regulation No 2024/1183, applicable from 2026) strengthens these provisions and introduces the European digital identity portfolio (EUDIW).

ETSI standards. The ETSI EN 319 132 standard defines the technical specifications of the PAdES format for PDF signatures. The ETSI EN 319 401 and ETSI EN 319 411 series frames the requirements applicable to trust service providers (TSPs). These standards are referenced in European Commission implementing acts and form the basis of QTSP compliance audits.

GDPR No 2016/679. The processing of personal data in the context of an electronic signature procedure (identity of the signatory, IP address, any biometric data) is subject to GDPR obligations: legal basis, information to persons, retention periods, data security and processor agreement with the platform.

Legal risks to know. Use of a signature by scanned image without digital traceability exposes the act to easy contestation, as no technical mechanism guarantees either the identity of the signatory or the integrity of the document. Similarly, choosing a simple signature (SES) for acts requiring an advanced or qualified signature (e.g. private deeds for certain property contracts, conventional terminations) may result in the nullity of the act or rejection of the document in court. It is advisable to define an internal signing policy, formalised by a charter or memorandum, specifying the level of signature required depending on the nature and stakes of each document.

Use cases: signing PDFs in different business contexts

An accountancy firm managing mandates and engagement letters

An accountancy firm with around twenty staff processes several hundred engagement letters, SEPA mandates and tax proxies each year. Before dematerialisation, each document had to be printed, sent by post, signed manually, then returned — an average cycle of 7 to 12 days. By deploying an advanced electronic signature solution on PDF, the firm reduces this timescale to less than 48 hours in over 85 % of cases, according to ranges consistent with sector benchmarks published by professional federations. The automatic audit trail also simplifies compliance checks by the Institute of Chartered Accountants. Calculation of return on investment can be estimated via a dedicated ROI simulation tool.

An industrial SME managing its supplier and subcontractor contracts

An industrial SME managing between 150 and 300 supplier contracts per year faces a challenge of traceability and timescale: some subcontractors are located abroad, which complicates postal exchanges. By choosing a PDF signature platform with advanced signature and qualified timestamping, the company secures the integrity of its framework contracts whilst reducing printing, shipping and physical filing costs. Legal and procurement teams access all signed documents through a central space, with filtering by status, date and signatory. For companies juggling multiple solutions or wishing to consolidate their tools, a migration to a unified platform often makes it possible to rationalise licence costs by 20 to 40 %.

A group of private clinics dematerialising patient consents and HR contracts

A group of private clinics with around 600 beds faces two distinct needs: on the one hand, the signature of informed consent forms by patients before medical procedures; on the other hand, the management of employment contracts, amendments and HR documents for nursing staff. The advanced electronic signature, deployed on tablet in the ward for patients and via web interface for HR, reduces administrative burden estimated at several hours per week per department. GDPR compliance is ensured by hosting signature data on HDS (Health Data Hosting) certified servers. Solutions specific to the healthcare sector natively integrate these particular regulatory constraints.

Frequently asked questions

How to sign a PDF document for free online?

Several platforms offer limited free access to PDF signing: Adobe Acrobat Reader (simple signature by image), Smallpdf or iLovePDF for basic uses. Beware: these free tools generally offer a simple electronic signature without in-depth identity verification, which limits their legal value. For contractual documents at stake, a paid solution offering traceability, audit trail and eIDAS compliance is essential.

What is the legal value of an electronically signed PDF?

An electronically signed PDF has full legal value in French and European law, provided that the method used complies with Articles 1366-1367 of the Civil Code and eIDAS Regulation No 910/2014. The evidential value depends on the level of signature: qualified signature is legally equivalent to a handwritten signature, whilst simple signature is admitted as evidence but may be more easily challenged. The audit trail significantly strengthens the robustness of the evidence.

Is it possible to sign a PDF protected by a password?

No, a PDF protected for writing (or "locked") cannot be electronically signed without first removing the protection. You must have the owner password to unlock the document, then import it into the signature platform. Some platforms automatically flag this type of conflict on sending. Once signed, the document can be re-protected if necessary, but only after signing.

How to verify that a PDF has been validly signed?

Adobe Acrobat Reader displays a validation banner for digital signatures when it detects PAdES signatures. For in-depth verification, dedicated tools such as the European Commission's online validator (DSS Validation) or tools provided by TSPs make it possible to check the certification chain, the revocation status of the certificate and the timestamp. An invalid signature or one with a revoked certificate is flagged explicitly.

Do you need specific software to sign a PDF or is a web browser sufficient?

Today, the majority of electronic signature solutions operate entirely in a web browser (SaaS), without software installation. The signatory receives a link by email, opens the document in their browser, authenticates (OTP code, identity verification) and signs in a few clicks. Some advanced use cases — in particular with qualified signature on USB token or smart card — require the installation of a driver or local component, but this remains marginal for common enterprise use cases.

Conclusion

Signing a PDF document online in 2026 is a task that is both technologically simple and legally demanding. The choice of the right level of signature — simple, advanced or qualified — determines the soundness of your acts in case of dispute. The PAdES format guarantees file integrity, whilst the audit trail reinforces proof of consent. GDPR obligations apply from the moment signatory data is collected.

Whether you are an SME, a professional firm or a large group, the challenge is to adopt a compliant, scalable solution integrated into your business processes. Certyneo offers an advanced and qualified electronic signature platform, 100% eIDAS compliant, with complete audit trail and European hosting.

Try Certyneo free of charge or consult our pricing to find the formula suited to your volume and compliance requirements.