Document security
Why a PDF signature is invalid after editing (and what to do)
By DeckleUpdated
A digital signature shows as invalid after editing because the signature covers the exact bytes of the file at signing time, and any later change, such as merging, rotating, adding a password or removing metadata, alters those bytes. Deckle saves each result as a new, rewritten file, so a signature on the original does not stay valid on the copy. Keep the signed original unchanged, and edit only a copy that does not need to carry the signature.
Three different privacy tasks
Password
Controls access
Metadata
Document properties
Redaction
Selected page content
Choose the change; inspect the saved copy
How to check a signature
- Open the signed original in a reader that validates signatures, such as Adobe Acrobat Reader.
- Open the signature panel. It lists each signature, the signer, and whether the document has been modified since signing.
- Open the edited copy the same way. If the signature is missing, invalid, or reported as modified, the copy no longer carries a valid signature.
- Use the signed original wherever the signature matters.
Preview on a Mac and browser viewers display a signature's appearance but do not always validate it. A visible signature on the page says nothing about whether it is still valid.
What breaks a signature
| Change | Breaks the signature? |
|---|---|
| Merging with another PDF | Yes |
| Removing, moving or rotating pages | Yes |
| Adding a password, or removing one | Yes |
| Removing metadata | Yes |
| Converting pages to images | Yes, and the signature data is lost entirely |
| Adding page numbers, a watermark or a stamp | Yes |
| Filling form fields allowed by a certifying signature, in a signature-aware app | Not necessarily; the signer can permit it |
| Adding a second signature in a signing app | Not if the app adds it as a new revision |
Signing apps can add changes in a way the original signature tolerates, by appending a new revision to the file and keeping the signed bytes intact. General PDF tools, including Deckle, write a new file instead.
What to do instead
You need to send part of a signed document. Send the signed original and tell the recipient which pages matter, or send an extracted copy with Split PDF together with the original for verification.
You need to combine a signed contract with other papers. Send the signed contract as its own file alongside the merged packet. If a single file is required, ask the signer to sign the combined document.
You need to rotate or fix pages. Ask the signer for a corrected, re-signed version, or keep the signed original as the record and use an edited copy for reading only.
You need to remove metadata or add a password. Do it before the document is signed. After signing, only the signing app can make changes without breaking the signature.
Certifying signatures and permitted changes
A certifying signature, often used by the author of a form, can allow certain later actions such as filling fields or adding comments. Those changes are made in a signature-aware app and shown as permitted. Deckle does not make permitted-change revisions, so any Deckle result is a new file outside the certified document.
Tips
- Name copies clearly.
contract-signed.pdfandcontract-reading-copy.pdfmake it obvious which carries the signature. - Never overwrite the signed original. Deckle does not overwrite files, but desktop editors may.
- Do every edit before signing. Clean, merge and protect the final version, then sign it.
- Check the signature panel, not the page. A signature image looks the same whether or not the signature is valid.
Frequently asked questions
Why does Acrobat say the document has been altered since it was signed?
The file's bytes changed after signing. Any edit, including in Deckle or another tool, causes it. Use the signed original.
Can I remove a password from a signed PDF without breaking the signature?
No. Unlocking rewrites the file without encryption, and the signature on the unlocked copy does not validate.
Does Deckle keep digital signatures when merging?
No. Merge PDFs creates a new file from the pages, and signatures from the parts are not kept valid in the result.
Is the signed file uploaded when I check it in Deckle?
Deckle does not validate signatures. Use a signature-aware reader for that. Any Deckle tool you use processes the file in your browser without uploading it.
Related tools
- Split PDF to make an unsigned reading copy of selected pages
- Remove PDF metadata to clean a document before it is signed
- Password protect PDF to protect a document before signing