How to sign a PDF online, step by step

To sign a PDF online, upload the final file to a signing platform, add each signer with their contact details, and send. Each signer opens a link — no account, no install — verifies with a one-time code, and signs. You get back a sealed PDF whose cryptographic evidence anyone can re-check in a validator.

There is also a genuinely free, manual path: print, sign with a pen, scan, email. It costs nothing and works; the scanned image simply carries none of the cryptographic evidence, so disputes later walk without the data that settles them. Both routes are covered below.

The signature binds the exact bytes of the file as uploaded — so the text, page count and attachments must be final before signing. If terms are still being negotiated, finish that first; re-signing is cheaper than unwinding.

Name the document and the document category when you send it for signature (in our API, the draft takes a title and a doc category, used for routing and retention). Contract type matters later: categories carry different retention clocks at keeping — originals, per-signature revisions and sealed finals are kept under the customer's retention settings — default maximums of 5 to 20 years by document type — then purged with cryptographic proof of erasure.

Every signer needs a way to be reached (email, phone) and an identity line: their full name as it must appear on the evidence. When people must sign in parallel — both parties free to sign at any time after sending — set the envelope's routing accordingly (the quickstart sample uses parallel); when your workflow needs a fixed order, add signers in the order they should act.

Sending dispatches a unique single-use token over a TLS-protected endpoint. That link is the only credential a signer needs.

Nothing installed, no account. They open the link from a phone or browser, verify with a one-time code sent by SMS or email, and sign by drawing their visual mark over the document's canvas. The ceremony follows the signer's preferred language.

What gets recorded beyond the mark: proof that the phone possession test passed (the one-time code they received), plus the truncated IP address and device details of the session. This is the evidence layer; the visual squiggle is only the human-readable part.

The final PDF is sealed with a PAdES signature. When an RFC 3161 authority answers, the signature is B-T; it is recorded as B-LT only when the signing service embeds the full validation material — both certificate chains and their revocation data — in the document security store and re-validates the result. The evidence pack states the level actually reached. Every envelope also carries a hash-chained audit trail and a public verification code that anyone can run without an account.

To check a returned document, open it in any PAdES-aware tool — Adobe Reader, the European Commission's open-source DSS validator — and read the signature panel, or run the verification code directly. What each check means is explained in full in our guide to what a B-T signature proves.

Print-sign-scan is free in the sense that matters: no paid service touches the file. What it cannot produce is the evidence itself — a scanned image has no digest binding content to the moment, no authority time, no revocation material; validity then rests on general law and whatever reconstruction witnesses will manage later.

A platform has running costs, so 'free' takes the shape of a trial: 14 days, 10 envelopes, no credit card required — each envelope signed during trial carries the full production evidence pack. After the trial it is 9 €/month. Whether the pipeline fits or the pen does, that trade is one of evidence, not of legality; see the next guide on wet versus electronic signatures for the legal side.