How to Sign a PDF Document Online: The Complete 2026 Guide

Each year, billions of PDF documents are exchanged between businesses, public administrations and individuals. Yet many still don't realise that signing a PDF document is far from a trivial action: the method chosen directly determines the legal value of the document, its admissibility in case of dispute and regulatory compliance with eIDAS. This 2026 guide explains step by step how to sign a PDF online, which tools to use, what level of signature to adopt depending on your context — and why certain common practices (scanned image, ticked box) expose your contracts to serious risks.

Different methods for signing a PDF document

Simple electronic signature (SES)

The most widespread method consists of affixing a simple electronic signature to a PDF file. It can take several forms: a validation click in a web interface, a ticked box, or even an image of a handwritten signature embedded in the document. This approach is quick and requires no in-depth identity verification.

Its use is suited to low-stakes documents: internal purchase orders, quotation validations, receipts of receipt. However, its probative value remains limited because it offers no guarantee as to the true identity of the signatory. By comparison, a scanned handwritten signature provides no greater legal security — and may even be more easily challenged than a properly executed SES.

Advanced electronic signature (AES)

The advanced signature complies with stricter technical requirements, as defined by the eIDAS regulation (article 26): it must be uniquely linked to the signatory, enable their identification, be created from data under their exclusive control, and detect any subsequent modification to the document.

In practice, an AES on PDF relies on a digital certificate issued after identity verification (often by video or identity document scan), associated with a cryptographic algorithm that "seals" the file. If the PDF content is modified after signature, the signature becomes invalid — constituting a fundamental integrity mechanism. AES is the recommended solution for the vast majority of commercial contracts, employment contracts and HR documents. HR-dedicated solutions systematically integrate this level of signature for dematerialised payslips and amendments.

Qualified electronic signature (QES)

At the top of the eIDAS hierarchy, the qualified signature is created using a qualified signature creation device (QSCD) and relies on a qualified certificate issued by a qualified trust service provider (QTSP), listed on the European Trusted Lists. In Union law, it has the same legal value as a handwritten signature — without needing to demonstrate its authenticity afterwards.

Its use is reserved for high-stakes documents: public procurement, dematerialised notarial deeds, certain corporate law documents. Its deployment requires a reinforced enrolment procedure (face-to-face or remote qualified identity verification). To understand the full technical and regulatory implications, consult our guide on eIDAS 2.0 regulation.

How to sign a PDF online: practical steps

Choosing the right signature platform

The market offers many solutions: DocuSign, Adobe Acrobat Sign, YouSign, Certyneo and others. To choose, several criteria are decisive:

• Signature level supported: not all platforms offer QES;

• eIDAS and GDPR compliance: data must be hosted or processed according to European protection rules;

• API integration: essential for high volumes or automation;

• Audit trail: each signature must be accompanied by a timestamped and tamper-proof log.

Our comparison of electronic signature solutions details these criteria to help you choose with confidence.

Preparing and sending the PDF document

• Check the source PDF: make sure it is not write-protected and does not contain conflicting form fields.

• Define signature areas: most platforms allow you to drag and drop "signature fields" to specific locations in the document.

• Identify the signatories: enter the email address, name and, depending on the required level, the phone number for OTP.

• Set the signature order: sequential (signatory B receives after A) or parallel (all notified simultaneously).

• Send and track: a secure link is sent to each signatory; the platform notifies the sender at each step.

Verify and archive the signed document

Once all signatories have affixed their signature, the platform generates a signed PDF containing the integrated cryptographic signatures and, in most cases, a completion certificate (audit trail). This file must be kept under conditions guaranteeing its integrity over time.

Electronic timestamping plays a key role here: it certifies the exact date and time of the signature, which can prove decisive in case of dispute. Solutions compliant with ETSI EN 319 132 integrate this timestamping automatically into the PDF file (PAdES format — PDF Advanced Electronic Signatures).

Technical formats for PDF signature

PAdES, CAdES, XAdES: what are the differences?

The PAdES format (PDF Advanced Electronic Signatures) is the European standard for signing PDF files. It integrates the signature directly into the file, making the document self-contained: no separate signature file is needed to verify its validity. PAdES is defined by the ETSI EN 319 132 standard and is the format recommended by the ANSSI for PDF signatures.

The CAdES (for binary files) and XAdES (for XML files) formats apply to other types of documents. In a PDF context, PAdES is always preferred.

Compliance profiles: B, T, LT, LTA

PAdES comes in several compliance profiles, from simplest to most robust:

• PAdES-B: basic signature, without timestamp;

• PAdES-T: includes a timestamp token;

• PAdES-LT: embeds revocation information (OCSP/CRL), allowing deferred validation;

• PAdES-LTA: adds an archive timestamp to guarantee validity over the long term (recommended for retention > 10 years).

For long-duration contracts — commercial leases, framework agreements, multi-year confidentiality agreements — the LTA profile is highly recommended, as it allows the signature to be validated even after the original certificate expires.

Security, traceability and best practices

The audit trail: indispensable proof in case of dispute

An electronic signature without an audit trail is a signature that is difficult to defend in court. The audit trail records all events related to the signature: document sending, opening by the signatory, IP address, timestamp, authentication method, OTP code used, etc.

This log constitutes an autonomous element of proof, distinct from the signed PDF itself. In case of dispute, it allows the exact chronology to be reconstructed and it to be demonstrated that the signature was indeed issued voluntarily by the identified person. Platforms compliant with eIDAS retain this data for the legally required duration.

Signatory authentication: the central issue

The strength of an electronic signature depends primarily on the robustness of signatory identification. Several methods can be distinguished:

• OTP code by SMS: basic level, sufficient for SES;

• Identity document verification by AI: required for AES in many contexts;

• Live video verification: standard for qualified certificates;

• Private key on smart card or USB token: reserved for professionals using QSCDs.

Electronic signature in business often involves combining several methods depending on signatory profiles: internal signatories (known employees) vs. external signatories (clients, partners, service providers).

GDPR and personal data of signatories

The collection of email addresses, phone numbers and identity document copies as part of a signature procedure constitutes processing of personal data under the GDPR (Regulation no. 2016/679). The signature platform acts as a data processor; it must provide a compliant DPA (Data Processing Agreement). Data must be deleted or anonymised at the end of the contractual retention period. Systematically check the location of servers: hosting outside the EEA without adequate guarantees exposes the company to CNIL sanctions.

Legal framework applicable to signing PDF documents

The electronic signature of PDF documents falls within a legal framework at several levels, articulating European law and national law.

French civil law. Article 1366 of the Civil Code provides that "electronic documents have the same probative force as paper documents, provided that the person from whom they emanate can be duly identified and they are established and kept under conditions guaranteeing their integrity". Article 1367 specifies that an electronic signature consists of "the use of a reliable identification process guaranteeing its link with the act to which it is attached". These provisions form the basis for the legal admissibility of PDF signatures in French law.

eIDAS Regulation no. 910/2014. This European regulation establishes three levels of signature (simple, advanced, qualified) and lays down the principle of non-discrimination: no electronic signature can be rejected solely on the ground that it is in electronic form. The qualified signature benefits from a legal presumption of equivalence with a handwritten signature (article 25, §2). eIDAS 2.0 Regulation (Regulation no. 2024/1183, applicable from 2026) strengthens these provisions and introduces the European digital identity wallet (EUDIW).

ETSI standards. The ETSI EN 319 132 standard defines the technical specifications of the PAdES format for PDF signatures. The ETSI EN 319 401 and ETSI EN 319 411 series sets out the requirements applicable to trust service providers (TSP). These standards are referenced in the implementing acts of the European Commission and form the basis for the audit of QTSP compliance.

GDPR no. 2016/679. The processing of personal data in the context of an electronic signature procedure (signatory identity, IP address, any biometric data) is subject to the obligations of GDPR: legal basis, information of individuals, retention periods, data security and data processor agreement with the platform.

Legal risks to be aware of. The use of a signature by scanned image without digital traceability exposes the document to an easy challenge, because no technical mechanism guarantees either the identity of the signatory or the integrity of the document. Similarly, opting for a simple signature (SES) for documents requiring an advanced or qualified signature (e.g. private deed documents for certain property contracts, negotiated terminations) may lead to nullity of the deed or rejection of the document in court. It is advisable to define an internal signature policy, formalised by a charter or service memorandum, specifying the level of signature required depending on the nature and stakes of each document.

Use scenarios: signing PDFs in different business contexts

An accounting firm managing mandates and engagement letters

An accounting firm with about twenty employees processes hundreds of engagement letters, SEPA mandates and tax authorisations each year. Before dematerialisation, each document had to be printed, sent by post, signed manually and then returned — an average cycle of 7 to 12 days. By deploying an advanced electronic signature solution on PDF, the firm reduces this timeframe to less than 48 hours in more than 85% of cases, according to ranges consistent with sector benchmarks published by professional federations. The automatic audit trail also simplifies Institute of Chartered Accountants checks. The return on investment calculation can be estimated via a dedicated ROI simulation tool.

An industrial SME managing its supplier and subcontractor contracts

An industrial SME managing between 150 and 300 supplier contracts per year faces the challenge of traceability and turnaround time: some subcontractors are located abroad, which complicates postal exchanges. By opting for a PDF signature platform with advanced signature and qualified timestamping, the company secures the integrity of its framework contracts while reducing printing, shipping and physical filing costs. Legal and procurement teams access all signed documents via a centralised space, with filtering by status, date and signatory. For companies juggling multiple solutions or wishing to consolidate their tools, a migration to a unified platform often makes it possible to rationalise licence costs by 20 to 40%.

A group of private clinics dematerialising patient consents and HR contracts

A group of private clinics with around 600 beds faces two distinct needs: on the one hand, the signature of informed consent forms by patients before medical procedures; on the other hand, the management of employment contracts, amendments and HR documents for healthcare teams. Advanced electronic signature, deployed on tablets in patient rooms for patients and via web interface for HR, reduces the administrative burden estimated at several hours per week per department. GDPR compliance is ensured by hosting health data on certified HDS (Health Data Hosting) servers. Solutions specific to the healthcare sector natively integrate these particular regulatory constraints.

Frequently asked questions

How can I sign a PDF document online for free?

Several platforms offer limited free access to signing PDFs: Adobe Acrobat Reader (simple signature by image), Smallpdf or iLovePDF for basic uses. Beware: these free tools generally offer a simple electronic signature without in-depth identity verification, which limits their legal value. For contractual documents at stake, a paid solution offering traceability, audit trail and eIDAS compliance is essential.

What is the legal value of an electronically signed PDF?

An electronically signed PDF has full legal value under French and European law, provided that the method used complies with articles 1366-1367 of the Civil Code and eIDAS Regulation no. 910/2014. The probative value depends on the level of signature: a qualified signature is legally equivalent to a handwritten signature, whilst a simple signature is accepted as evidence but may be more easily contested. The audit trail considerably strengthens the robustness of the evidence.

Is it possible to sign a password-protected PDF?

No, a PDF protected for writing (or "locked") cannot be electronically signed without first removing the protection. You must have the proprietary password to unlock the document, then import it into the signature platform. Some platforms automatically flag this type of conflict when sending. Once signed, the document can be re-protected if necessary, but only after the signature.

How can I verify that a PDF has been validly signed?

Adobe Acrobat Reader displays a digital signature validation banner when it detects PAdES signatures. For thorough verification, dedicated tools such as the European Commission's online validator (DSS Validation) or tools offered by TSPs allow you to check the certification chain, the certificate revocation status and the timestamp. An invalid signature or one whose certificate has been revoked is explicitly reported.

Do I need specific software to sign a PDF or is a web browser enough?

Nowadays, the majority of electronic signature solutions work entirely in a web browser (SaaS), without software installation. The signatory receives a link by email, opens the document in their browser, authenticates (OTP code, identity verification) and signs in a few clicks. Some advanced use cases — notably with qualified signature on USB token or smart card — require the installation of a driver or local component, but this remains marginal for common business uses.

Conclusion

Signing a PDF document online in 2026 is a task that is both technologically simple and legally demanding. The choice of the right level of signature — simple, advanced or qualified — determines the robustness of your documents in case of dispute. The PAdES format guarantees file integrity, whilst the audit trail strengthens proof of consent. GDPR obligations apply from the moment signatory data is collected.

Whether you are an SME, a professional firm or a large group, the key is to adopt a solution that is compliant, scalable and integrated into your business processes. Certyneo offers an advanced and qualified electronic signature platform, 100% eIDAS compliant, with complete audit trail and European hosting.

Try Certyneo free of charge or check our pricing to find the package suited to your volume and compliance requirements.