Digitally certify a PDF — key on your device
A real cryptographic signature that proves the file hasn’t changed since you signed it.
Certify PDF now — free →Bindery generates a 2048-bit RSA signing key in your browser that cannot be exported, wraps it in a self-signed certificate, and embeds a standards-compliant detached CMS signature (SHA-256 + RSA) in the PDF. Acrobat and other readers verify the integrity; the file is self-checked before it is written.
Honest scope: the certificate is self-signed, so readers show the identity as untrusted — it proves the document is unchanged since a specific key signed it, not who controls the key. No certificate authority, no server, nothing uploaded. Bindery runs entirely in your browser — your file is never uploaded, so there is nothing to delete from a server afterwards.
How it works
- Create your signing key once — it stays in this browser
- Choose the page and position for the signature box
- Certify: the hash is signed on your device and verified before download
Questions people ask
Is this a “real” digital signature?
Yes — a PAdES-style detached CMS signature over the document bytes, with the certificate embedded. It is cryptographically verifiable; what it lacks is a certificate authority vouching for your identity.
Where is my private key stored?
In your browser’s IndexedDB, generated non-extractable by WebCrypto. It cannot be read out, exported, or sent anywhere — including to Bindery.
Why does my reader say the signer is untrusted?
Because the certificate is self-signed. The signature is still valid and tamper-evident; trust in the identity requires a certificate authority, which Bindery deliberately does not involve.