Digitally certify a PDF — key on your device
A real cryptographic signature that proves the file hasn’t changed since you signed it.
Free: 3 jobs per UTC day, 25 MB per file. PDF exports include a visible Made with Bindery watermark. Pro exports clean PDFs.
Prefer the full studio? Open Certify PDF in the app →
Bindery generates a 2048-bit RSA signing key in your browser that cannot be exported, wraps it in a self-signed certificate, and embeds a standards-compliant detached CMS signature (SHA-256 + RSA) in the PDF. Acrobat and other readers verify the integrity; the file is self-checked before it is written.
Honest scope: the certificate is self-signed, so readers show the identity as untrusted — it proves the document is unchanged since a specific key signed it, not who controls the key. No certificate authority, no server, nothing uploaded. Bindery runs entirely in your browser — your file is never uploaded, so there is nothing to delete from a server afterwards.
How it works
- Create your signing key once — it stays in this browser
- Choose the page and position for the signature box
- Certify: the hash is signed on your device and verified before download
A signature you can verify, made on your device
A digital certification is mathematics, not a picture. Bindery generates a 2048-bit RSA key pair in your browser — non-extractable, so it cannot be copied out even by you — wraps the public half in a self-signed certificate, and embeds a detached CMS signature (SHA-256 with RSA, the PAdES style readers expect) in the PDF. Any reader that understands signatures can then check that the file’s bytes are exactly what was signed. Change one character and the signature shows as invalid. Optionally, an RFC 3161 timestamp from a public timestamp authority proves when the signature existed; only the hash of the signature leaves your device for that.
Self-signed means: proof of integrity, not identity
Readers show a self-signed certificate as “untrusted” because no certificate authority vouches for who owns the key. That is the honest scope: the certification proves the document has not changed since a specific key signed it, and that the same key signed other documents you certified — not who controls the key. When a counterparty needs identity assurance, a qualified or CA-issued certificate from a provider is the tool. When the need is tamper evidence — a quote, a report, a delivered file — this is enough, and the verification tool lets anyone check it on their device.
Certifying in the browser versus uploading
| Certify PDF | Bindery | Upload-based tools |
|---|---|---|
| Where the file is processed | In your browser tab, on your device | Uploaded to the service’s servers |
| Private key | Generated non-extractable in your browser; never leaves it | Held by the service |
| Signing | The hash is signed on the device | The document is uploaded and signed on a server |
| Timestamp | Optional RFC 3161 token; only a hash is sent | Varies |
| What exists afterwards | The original and the new file, both on your device | A server copy until the retention window ends |
| Works offline | Yes, once the app has loaded | No |
Use it well
- Certify last. Any later change — even filling a field — invalidates the signature, which is the point.
- Put a visible signature on the page first if a human should see one; the certification is invisible apart from the reader’s signature panel.
- Keep using the same browser profile: the key lives in its storage, and a new profile means a new key. Or import your organisation’s .p12/.pfx certificate and sign with that.
- For a multi-party contract with an audit trail, Request signatures certifies and timestamps the completed file automatically.
Questions people ask
Is this a “real” digital signature?
Yes — a PAdES-style detached CMS signature over the document bytes, with the certificate embedded. It is cryptographically verifiable; what it lacks is a certificate authority vouching for your identity.
Where is my private key stored?
In your browser’s IndexedDB, generated non-extractable by WebCrypto. It cannot be read out, exported, or sent anywhere — including to Bindery.
Why does my reader say the signer is untrusted?
Because the certificate is self-signed. The signature is still valid and tamper-evident; trust in the identity requires a certificate authority, which Bindery deliberately does not involve.
Will Adobe Acrobat validate the signature?
It validates the integrity — the document is unchanged — and reports the signer’s identity as unknown or untrusted because the certificate is self-signed. That is expected. Bindery’s Verify tool shows the same result with the reason spelled out.
What happens if I clear my browser data?
The key is deleted with it, and you cannot certify with that key again. Documents already certified remain verifiable, since the certificate is embedded in each of them.
Can I use my own certificate?
Yes. Import a .p12 or .pfx issued by your organisation or a certificate authority. It is decrypted on this device, the private key is imported non-extractable into the browser, and the password never leaves your machine. Signatures then carry your issued certificate instead of a self-signed one.