# Sign a PDF

Digitally sign a PDF with a certificate, from your Windows certificate store or a `.pfx` / `.p12` file, with **Sign Document...**. To put a picture of your handwritten signature on a page instead, see [Add an image to a PDF](Add-an-image-to-a-PDF.md).

**Available in [pre-release 3.7](https://www.sumatrapdfreader.org/prerelease)**

**Right-click the page → Document → Sign Document..., pick a certificate, click Sign, then save.** At a glance:

- **Sign Document...** (`CmdSignDocument`) — adds a cryptographic signature (PKCS#7) made with your certificate's private key.
- **Certificate:** one from your Windows certificate store, or a `.pfx` / `.p12` file and its password.
- **Where:** an empty signature field in the PDF, or a new signature box you draw on the page.
- **Appearance:** choose the lines shown in the signature box, and add a PNG or JPEG image.
- **Command line:** `sumatrapdf-tool sign` signs the PDF's signature fields with a `.pfx` file.

A digital signature shows who signed and whether the PDF changed after signing. To sign you need a certificate with a private key: one issued to you (by your employer, a government ID card, a certificate authority) or one you made yourself. Other PDF readers trust the signature only if they trust the certificate.

## Sign a PDF

1. Open the PDF.
2. Start **Sign Document...** in any of these ways:
   - Right-click the page → **Document → Sign Document...**
   - `Ctrl + K`, then `Sign Document` in [Command Palette](Command-Palette.md)
   - Click an empty signature field in the PDF. The dialog opens with that field selected.
3. In the **Sign Document** dialog, pick the **Certificate:** (see [Choose a certificate](#choose-a-certificate)).
4. Optionally fill in **Reason (optional):** and **Location (optional):**. They are shown in the signature box.
5. Pick **Where to sign:**
   - **Empty signature field: name (page N)** — a signature field the PDF already has. These come first in the list.
   - **New signature on page N** — a new signature on the current page.
6. Optionally change the **Appearance:** (see [Change how the signature looks](#change-how-the-signature-looks)).
7. Click **Sign**.
   - For a new signature, the dialog hides and asks you to *Click or drag on the page to place the signature*. Drag a box, or click to place a box of the default size (2 × 0.75 inches) centered where you clicked. `Esc` brings the dialog back.
   - If you selected something on the page before opening the dialog, the new signature fills the selection's rectangle instead.
8. A save dialog opens. The signature is computed when the file is written, so you save right away. It suggests `<name> Copy.pdf`; pick the original file name to sign it in place.

The signed PDF opens in SumatraPDF. Signatures already in the document stay valid: the new one is appended to the file.

**Cancel** or `Esc` closes the dialog without signing.

## Choose a certificate

The **Certificate:** drop-down lists the certificates in your Windows Personal certificate store that have a private key, are valid today and may be used for signing, as *name (expires yyyy-mm-dd)*. If there are any, the first one is selected.

To sign with a certificate file:

1. Pick **Certificate file...**, the last item in the drop-down.
2. Type the path, or click **Browse...** and pick a `.pfx` or `.p12` file.
3. Type its **Password:**.

If the password is wrong, you get *Wrong password for the certificate file.*

## Change how the signature looks

Under **Appearance:**, check what the signature box shows. All are on by default:

- **Show labels** — "Digitally signed by", "DN:", "Date:" and similar labels
- **Show name** — the signer's name
- **Show DN** — the certificate's distinguished name
- **Show date** — the signing date and time
- **Show name as graphic** — the name in large letters on the left

**Image (optional):** click **Choose...** and pick a PNG or JPEG, for example a scan of your handwritten signature. It is drawn on the left instead of the large name.

SumatraPDF remembers these choices until you close it. If you turn off the name, DN and date and leave reason and location empty, the name is shown anyway so the box isn't blank.

## Check a signature

Open **Properties** (`Ctrl + D`) of a signed PDF: it lists each signature with the signer, whether the certificate is trusted and whether the document changed since signing.

## Sign from the command line

`sumatrapdf-tool sign` works with signature fields the PDF already has and a `.pfx` certificate file. It can't add a new signature field.

List the signature fields and their object numbers:

```
sumatrapdf-tool sign form.pdf
```

```
   12: Signature is not signed.
```

Sign field `12`:

```
sumatrapdf-tool sign -s me.pfx -P password -o signed.pdf form.pdf 12
```

Verify the signatures:

```
sumatrapdf-tool sign -v signed.pdf
```

```
Verifying signature 12:
	Distinguished name: cn=Jamie Rivera, o=Example, ou=, email=, c=
	Certificate error: Self-signed certificate.
	The document is unchanged since signing.
	The fields signed by this signature are unchanged.
```

Without `-o` the signed PDF is written to `out.pdf`. All options: [sumatrapdf-tool sign](Tool-sign.md).

## Tips

- Fill in the form and [flatten it](Flatten-PDF-forms-and-annotations.md) before you sign. Baking a signed PDF removes the signature.
- Sign into a new file (the suggested `<name> Copy.pdf`) to keep the unsigned original.
- Use a PNG of your handwritten signature as the **Image** to get a signature that looks signed and is also verifiable.
- A self-signed certificate works, but readers show it as not trusted.

## See also

- [Add an image to a PDF](Add-an-image-to-a-PDF.md) — a picture of your signature, without a certificate
- [Fill a PDF form](Fill-PDF-forms.md) — fill in the form before signing
- [Flatten PDF forms and annotations](Flatten-PDF-forms-and-annotations.md)
- [All cmd-line tools](Tools.md)