BASALT · JOURNAL
How to sign a PDF on a Mac, and what a signature on a page is worth
A contract comes back and it needs your signature today. On a Mac, two entirely different operations go by the word "signing", and they answer different questions. Knowing which one you are performing, and which one the recipient expects, prevents an argument later.
Two different things called signing
The first is an image of a signature: ink strokes, scanned from paper or captured from a trackpad, drawn onto the page like any other graphic. It carries no cryptographic claim. Anyone with a PDF editor can move it, delete it, or paste it onto a different document.
The second is a digital signature, a cryptographic operation over the bytes of the file. The signer's software computes a digest across specified spans and signs it with a private key whose certificate binds it to an identity. The result lives in a signature dictionary alongside a /ByteRange array naming exactly which spans are covered, usually everything except the hole reserved for the signature value itself. A verifying viewer recomputes that digest and compares. Change one byte inside the covered range and the comparison fails.
Those are not two grades of one feature. One is a drawing, one is a tamper-evidence mechanism.
The picture is what most workflows run on
Electronic signature law in most jurisdictions turns on intent and attribution, not on public key infrastructure. A counterparty, a landlord, or opposing counsel wants to see a signature on the page next to the right name, and their process is to look at it. Very few recipients ever open the signature panel of their viewer.
So the honest framing is this: a signature image proves nothing about who placed it, and it is still what the workflow you are in almost certainly wants. Reach for the cryptography when someone has specifically asked for it.
What the image is once it lands on the page
Placed on a page, a signature becomes either a Form XObject painted by the content stream or an annotation carrying an appearance stream. Three details decide whether it looks right.
Transparency. A scanned signature is a dark shape on a white rectangle, and that rectangle covers the printed signature line underneath. The portable fix is an alpha channel, which in PDF terms is a soft mask (/SMask) in the image dictionary. A multiply blend mode also works, but only inside a proper transparency group, so it renders inconsistently across viewers.
Resolution. A signature captured at 150 dpi and scaled up looks exactly like that, most obviously in print. Capture at 300 dpi or higher, or draw it as vector paths so it stays crisp at any zoom.
Placement. Compute the position from the page's CropBox, not from an assumed origin at (0, 0), and account for /Rotate. A fixed offset drifts on cropped pages and lands sideways on rotated ones.
Annotation or page content
An annotation is a separate object: deletable in one action by any editor, and it prints only if the /Print flag in its /F field is set. Page content is part of the page, so it prints, survives flattening, and cannot be dragged away.
For a signature image the content stream is the more honest destination. It makes the picture as permanent as the rest of the page instead of a sticker sitting on top. The same tradeoff appears in adding a watermark that survives the print. The exception is a form signature field, where the widget annotation is a required part of the certificate-based machinery.
What real digital signing costs
You need a certificate from an authority whose root the verifying software trusts. A self-signed certificate works mechanically but displays as validity unknown, which many recipients read as broken. You also want a timestamp from a time stamping authority, otherwise validity becomes questionable once the certificate expires.
Then there is the incremental update problem. PDF signing appends, so any later edit is written as an incremental update at the end of the file. The original signature stays valid over its own byte range while the visible document differs, and viewers correctly report the document as modified after signing. This is why signing is always the last step: annotate, stamp, number, and redact first, then sign.
Frequently asked questions
How do I sign a PDF on a Mac?
Open the document in a PDF application that supports signature placement, capture or import your signature, position it, and save to a new file. Preview does this by storing the signature as a markup annotation, while dedicated applications can write it into the page content so it cannot be dragged off. Sign last, after every other edit, because later changes are what break signatures.
Is a signature image legally valid?
In most jurisdictions an electronic signature is valid based on intent to sign and attribution to the signer, not on cryptography, so a signature image is routinely accepted in business and legal workflows. It proves nothing technically, since anyone can copy it onto another document. If your process specifically requires certificate-based verification, ask for that, because the two mechanisms are not interchangeable.
What is the difference between a digital signature and an electronic signature?
A digital signature is a cryptographic operation over a defined byte range of the file, so any later change to those bytes is detectable by a verifying viewer. An electronic signature is the broader legal concept of signing by electronic means, covering typed names, clicked checkboxes, and drawn images. Every digital signature is an electronic signature; almost no electronic signature is a digital one.
Why does my signature have a white box around it?
Your signature image has no transparency, so the white paper it was scanned from is painted onto the page along with the ink. Give the image an alpha channel, which becomes a soft mask in the PDF image dictionary, or draw the signature as vector paths instead of a bitmap. A multiply blend mode also works but needs an enclosing transparency group to render reliably.
Can Preview add a digital signature to a PDF?
No. Preview places signature images as markup annotations and has no support for certificate-based signing, timestamping, or signature validation. If you need a cryptographic signature with a trusted certificate chain, you need software built for that purpose plus a certificate from an authority the recipient's viewer already trusts.
Will my signature still show when I print the PDF?
It depends how it was added. A signature written into the page content stream always prints, because it is part of the page. A signature stored as an annotation prints only if its print flag is set, and some tools leave that flag clear, which is why a signature can appear on screen and vanish on paper. Print to PDF once and check.
Does editing a PDF after signing break the signature?
It breaks a cryptographic signature and leaves a signature image untouched. Edits are appended as incremental updates, so the digest over the original byte range still matches while the visible document has changed, and viewers report the document as modified after signing. A signature image is only a graphic, so nothing about it detects the change, which is exactly its limitation.
How do I sign many PDFs at once?
Use a tool that saves the sequence of steps so the same signature lands at the same computed position on every file, instead of opening each document by hand. The position has to derive from each page's own geometry, since a batch will not share one page size or rotation. That is a job for a repeatable procedure, covered in running the same PDF steps repeatedly.
Doing it in Basalt
Basalt's SIGN tool places your signature on a page and writes a new file, so the original is never modified. It does not issue certificate-based digital signatures and does not pretend to: what it gives you is the signature image that ordinary business and legal workflows actually use and accept. Everything runs in a sealed engine process holding no network entitlement, enforced by macOS at the code-signature level, so your contracts never leave the Mac, with no account and no telemetry. Signing sits alongside 17 other tools in the same window, including redact, watermark, and Bates numbering, for $29 once across up to three Macs, free for 24 hours, at basaltformac.com.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.