{
  "id": 18842379,
  "title": "Why your PDF signature breaks the moment someone edits the file",
  "url": "https://urgent.news/2026/11/08/why-your-pdf-signature-breaks-the-moment-someone-edits-the-file",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-08T02:22:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hui_tian_5deae5180687cd80/why-your-pdf-signature-breaks-the-moment-someone-edits-the-file-2706"
  },
  "original_language": "en",
  "account": "A client sent a signed supplier agreement with minor changes, yet the signature appeared invalid. This highlights the fundamental flaw in PDF signature verification - it only checks the file's bytes, not the document's actual content. When you sign a PDF, the tool signs specific byte ranges, not the meaning of the document. If those ranges shift due to edits, the signature becomes invalid. PDFs support incremental updates, meaning adding comments or new signatures appends data to the end of the file while preserving the original byte ranges. This can lead to two outcomes: the signature remains technically valid but covers outdated content, or the signature becomes invalid entirely. To differentiate between these situations, use tools like pdfsig to check signature validity and coverage. The most common scenario involves a signed contract being edited for minor changes, causing both the signature and its coverage to disappear. To avoid this, always re-sign the document if any changes occur after initial signing. Additionally, verify the signature's integrity before sending the file, and choose the appropriate type of signature based on regulatory requirements.",
  "summary": "A client sent me a signed supplier agreement last month with a note: \"we changed one date in appendix 2, that's fine right?\" The signature panel in their viewer still showed a green tick. In mine it said the signature was invalid. Both of us were looking at the same file. That disagreement is the whole problem with PDF signatures, and it is worth understanding before it happens to a contract you…",
  "key_points": [
    "PDF signatures verify file bytes, not content",
    "Editing PDF shifts byte ranges, invalidates signature",
    "Re-sign document after changes to maintain signature validity"
  ],
  "editors_take": "The disconnect between byte-level verification and document content creates a technical vulnerability where even minor edits can inadvertently invalidate legal agreements or hide outdated information from signers.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}