Sign with a certificate or USB token
Press S for Fill & Sign, drag a rectangle where the signature goes, then draw or type your name, or choose a keychain certificate, smart card or USB token. Certificate signatures are written as PAdES in an incremental update, with an optional RFC 3161 time-stamp. Signing is free.
Sign
- Open the PDF and press S for Fill & Sign.
- Drag a rectangle on the page where the signature should go. Move or resize it afterwards; Esc cancels.
- In the inspector, choose how to sign: type or draw your name for a visual signature, or pick a certificate for a digital one.
- Sign. Better PDF asks where to save the signed copy, named
<name> signed.pdfby default.
Which certificates work
- Keychain identities, including smart cards and tokens whose maker ships a CryptoTokenKit driver. These work in both editions.
- USB tokens that need a PKCS#11 driver, such as the Watchdata ProxKey. These need the direct download from betterpdf.co, because the App Store edition is sandboxed and cannot load the driver.
What gets written
Better PDF writes a PAdES signature (CMS) as an incremental update: the signature is appended after the original bytes, which are not rewritten.
Time-stamps are optional and off by default. Turn them on in Settings › Signing to add an RFC 3161 time-stamp from the server set there. Only a hash of the signature is sent, never the document.
Your PIN
When a token asks for its PIN you can choose to be asked every time, to have it remembered until you quit, or to keep it in the Keychain behind Touch ID. Forget a remembered PIN in Settings.
Checking signatures
When you open a signed PDF, Better PDF checks its signatures on your Mac and shows the result in the status bar. The Signatures panel lists each one: unchanged since signing, time-stamped, certificate valid or untrusted root, and changed after signing. You can view the certificate and choose to trust its root. Revocation is not checked online.
To control how the signature looks on the page, see Signature styles.