Digital Signature
Sign a PDF with your own .p12 / .pfx certificate. Toolula builds a cryptographic PAdES signature with an optional trusted timestamp, entirely on your device.
About this tool
Digital Signature for PDF — Sign with Your .p12 Certificate (PAdES)
Sign a PDF cryptographically with your own .p12 or .pfx certificate and an RFC 3161 timestamp. The document, the certificate and its password never leave your browser.
A Real Signature, Not a Picture
Toolula writes a PAdES (ETSI.CAdES.detached) signature into the PDF: any later change to the file breaks it, and Acrobat or any PAdES validator shows who signed and when.
Your Certificate Stays on Your Device
The .p12 / .pfx is opened in the browser tab and its private key is held as a non-exportable Web Crypto key. Only a 32-byte fingerprint goes to the time-stamp authority.
Visible Stamp, Existing Signatures Kept
Place a signature stamp anywhere, add your handwriting if you like, and sign documents that already carry signatures — the new one is appended as an incremental update, so earlier ones stay valid.
How to use it
- Drop the PDF you want to sign.
- Choose your .p12 or .pfx certificate, enter its password and open it. No certificate yet? Create a test certificate to try the tool.
- Choose a visible stamp and drag it into place, or sign invisibly. Add your handwritten signature, a reason and a location if you like.
- Leave the trusted timestamp on, so the signing time comes from a time-stamp authority instead of your device clock.
- Click Sign PDF. The new signature is verified on your device before you download the file.
Frequently asked questions
Is this signature legally valid under eIDAS?
With a certificate from a recognised CA that identifies you, the result is an advanced electronic signature (AdES) in the PAdES format. A qualified electronic signature (QES) additionally requires a qualified certificate on a qualified signature device such as a smart card or remote HSM, which a .p12 file is not.
Why does Acrobat say the signer's identity is unknown?
Acrobat shows a green check only when the certificate chains to the Adobe Approved Trust List or the EU Trusted Lists. Self-signed and test certificates still prove the document is unchanged, but not who signed it.
Where do I get a .p12 or .pfx certificate?
From a trust-service provider that issues personal or company signing certificates, or from your organisation's IT department. Export it from your certificate store as .p12 or .pfx including the private key; Toolula supports RSA and ECDSA keys.
Why can't this PDF be signed?
Password-protected PDFs have to be unlocked first. A PDF that was certified with "no changes allowed" cannot take another signature without breaking the certification, so Toolula refuses to sign it.
Is my certificate or password uploaded?
No. The PDF and the certificate are read inside your browser tab. With the timestamp switched on, only the SHA-256 hash of the signature value is sent to a public RFC 3161 time-stamp authority.
Is it really free?
Yes. You can use every Toolula PDF tool for free, without an account. The free plan has fair-use limits; Toolula Pro, an optional plan, raises them and adds advanced features.