Make a PAdES signature on a PDF
Sign a PDF with your own certificate (.pfx or .p12 file, USB token or smart card) and choose how much long-term proof goes into it. No account needed. No certificate? Make a free self-signed Digital ID in the tool.
- Secure & private
- Works on any device
- Nothing to install
- Your own certificate (.pfx)
- A cryptographic PAdES signature
- Optional trusted timestamp
- Checked before you download it
Drag & drop files here
or choose a file from your device
Upload the PDF you want to sign
.pdf · one document, or up to 20 signed together · the documents and your certificate are used once and deleted
The four PAdES baseline levels
PAdES is the European standard for signatures inside a PDF (ETSI EN 319 142). Each level adds to the one before it.
| Level | What it adds | Why it matters | In the tool |
|---|---|---|---|
| B-B | The signature itself, made with your certificate | Proves who signed and that the file has not changed since | Trusted timestamp off |
| B-T | A trusted timestamp from an independent authority (RFC 3161) | Proves when it was signed, not just what your computer clock said | Trusted timestamp on |
| B-LT | Revocation proof (OCSP/CRL answers) stored in the file: LTV | The signature can still be checked after your certificate expires | Timestamp and LTV on (the default) |
| B-LTA | An archive timestamp over all of it | Keeps the proof checkable for many years, for archiving | Timestamp, LTV and archive timestamp on |
Each switch needs the one before it: no LTV without a timestamp, no archive timestamp without LTV.
Which PAdES level should you choose?
- B-B is enough when the file is checked soon after signing and only the signer's identity matters.
- B-T is the sensible minimum for anything that might be questioned later, because the time comes from an authority, not from your computer.
- B-LT is what most tender portals, banks and public bodies in Europe mean when they ask for a PAdES signature that "validates long term". It is the tool's default.
- B-LTA is for documents you must keep for many years, such as signed policies, board minutes or archived contracts.
When a portal asks for "PAdES" without a level, B-LT is the safe choice.
Checking the result
Every signature is validated on our side before you download it, and the result card says whether the timestamp, the LTV data and the archive timestamp went in. To check it again later, or to check a file someone else signed, use Verify Signature: it reads every signature in the file, checks the certificate chain and revocation live, looks the issuer up in the EU Trusted Lists and Adobe's AATL, and gives you a PDF report and an ETSI TS 119 102-2 validation report in XML.
PAdES is not the same as an e-signature request
A PAdES signature is made with your certificate, so it is the right tool when you sign yourself. When you need several other people to sign one document, use Request Signatures instead: it produces simple electronic signatures with a certificate of completion and a timestamp seal. Our posts on long-term validation and what an archive timestamp adds go deeper.
What we do not do
We do not issue certificates, and a self-signed Digital ID is not a qualified signature. A qualified electronic signature under eIDAS needs a qualified certificate from a trust service provider; if you have one on a smart card or a USB token, this tool can sign with it.
PAdES signature: common questions
What is a PAdES signature?
A digital signature stored inside a PDF according to the European standard ETSI EN 319 142. It proves who signed and shows if the file changes afterwards.
What are the PAdES levels?
B-B (the signature), B-T (plus a trusted timestamp), B-LT (plus revocation proof for long-term validation) and B-LTA (plus an archive timestamp).
Can I make a PAdES signature for free?
Yes. Digital Signature on this page signs with your own certificate at any of the four levels, with no account.
Is a PAdES signature a qualified signature?
Only if it is made with a qualified certificate on a qualified device. PAdES is the format; the certificate decides the eIDAS level.
How do I check a PAdES signature?
Open the file in Verify Signature. It shows the level, the timestamp, LTV data and whether the issuer is on the EU Trusted Lists, and gives you an ETSI validation report.