Seal, signature, qualified signature: what actually binds you

The word "signature" covers three things

When someone says "I signed the PDF", they may mean three incompatible things. The misunderstanding is common, and the bill arrives when the document is challenged — that is, at the only moment the signature was meant to be useful.

A drawn signature

This is an image placed on the page: your initials drawn with a mouse or finger, or photographed then cut out. It is worth what a scanned initial is worth.

What it gives you: it is immediate, free, and enough for the vast majority of everyday exchanges — a quote, an internal authorisation, a purchase order between people who know each other.

What it proves: technically, nothing. It can be copied from one document to another with a plain copy-paste. It says neither who placed it nor whether the text above has changed since. If someone alters the amount afterwards, the signature stays there, intact and useless.

An electronic seal

This is something else, and "seal" is not an elegant synonym for "signature": it is a distinct category in the eIDAS regulation.

A seal is computed from the document's content, using a private key. Change a single byte of the file — a comma, a digit, a space — and the computation no longer comes out right. The tampering becomes detectable by anyone, without needing to compare against an original.

What it proves: that the document really comes from the organisation holding the key, and that it has not been modified since. Integrity and origin.

What it does not prove: a person's commitment. A seal belongs to a legal entity — a company, a public body — not to a named individual. It attests "this document came from us and has not moved", not "so-and-so agrees".

A qualified electronic signature

This is the only level that the eIDAS regulation recognises as equivalent to a handwritten signature across the whole European Union.

It requires a qualified certificate issued to a natural person by a qualified trust service provider, after verifying their identity, and signature creation on a certified device. Those constraints are not paperwork: they are what makes the signature bind someone.

What it gives you: the burden of proof is reversed. Before a court, it is for the challenger to show the signature is invalid, not for you to show that it is valid.

You do not get one by ticking a box on a website. It goes through a qualified provider, with identity verification, and it costs money.

Two distinctions that make the difference

They come up in almost every misunderstanding.

• Integrity is not trust. Verifying a signature tells you the document has not been modified and that the signature matches the certificate. It does not tell you whether the certificate belongs to anyone trustworthy — anyone can make a certificate and sign with it. "Has this document moved?" is computed; "can I believe this issuer?" is decided.
• A declared date is not an attested date. The date written into a signature is whatever the signer's clock announced, and clocks can be set. For a date to hold up, you need a timestamp issued by an independent third party attesting that the document existed at that moment.

Checking is free and should be a reflex

Receiving a signed document and not checking the signature is like accepting a cheque without looking at the amount.

Our verification tool reads every signature in a PDF and gives a separate verdict for each: content unchanged or not, signature matching the certificate or not, and any reservations. It is open, with no account and no quota — refusing to let someone check a document would be absurd.

What it will not do, and what no tool can do for you: decide whether the authority that issued the certificate deserves your trust. That question is yours.