Is a signature drawn on a PDF legally valid?

Guides · Updated 12 August 2026 · 9 min read

The short answer, in the EU and the US alike, is usually yes — a signature you draw on a PDF can form a binding agreement. The useful answer is that "valid" and "provable" are different questions, and the gap between them is where the interesting problems live.

Two different things called a signature

The word covers two technologies that have almost nothing in common.

A drawn or imported signature is a picture. You trace your name with a mouse, a finger or a stylus, or you import a scan of it, and the tool places that image on the page. It looks like a signature and it expresses your intent to be bound. What it does not do is tie itself to the document: the image can be lifted from one PDF and dropped on another, and the file can be altered afterwards without leaving a mark.

A cryptographic (digital) signature is a computation. The signing software hashes the file's bytes and encrypts that hash with a private key held in a certificate issued to a verified identity. The result is embedded in the PDF, and any reader can recompute the hash and check it. Change one byte after signing and verification fails. In PDF this is standardised as PAdES.

Both are "electronic signatures" in law. They sit at different points on a scale of evidential strength, and the drawn one is at the bottom of it.

What EU law actually says

In the European Union the reference is the eIDAS Regulation (No 910/2014), which defines three levels:

• Simple electronic signature (SES). Any data in electronic form attached to or logically associated with other data and used to sign. A drawn signature qualifies. So does a typed name at the end of an email.
• Advanced electronic signature (AdES). Must be uniquely linked to the signatory, capable of identifying them, created using data the signatory can use under their sole control, and linked to the signed data so that any later change is detectable. In practice this means a certificate-based signature.
• Qualified electronic signature (QES). An advanced signature created on a qualified signature creation device with a qualified certificate from a trust service provider on the EU trusted list. Article 25 gives it the same legal effect as a handwritten signature across all member states.

The crucial provision is Article 25(1): a signature cannot be denied legal effect or admissibility solely because it is electronic or because it does not reach the qualified level. A simple signature is admissible evidence. It is simply weaker evidence — and, decisively, the burden of proving it is genuine falls on the party relying on it, whereas a qualified signature is presumed genuine and the other side has to disprove it.

And in the United States

The US takes a broader, less tiered approach. The federal ESIGN Act (2000) and the UETA, adopted by nearly every state, establish that a signature may not be denied legal effect merely because it is in electronic form. There is no statutory equivalent of the eIDAS three-level ladder.

What US law asks instead is whether the signature is attributable to the person: can you show it was their act? That is an evidentiary question, answered with whatever record you kept — the email thread, the authentication used, the audit trail, the conduct of the parties afterwards. A drawn signature with a good audit trail can be perfectly defensible; the same signature with no surrounding record is much weaker.

Both regimes carve out categories where electronic signing is excluded or restricted — wills and testamentary trusts, some family-law documents, certain court filings, and specific notice requirements. These lists differ by jurisdiction, and they are the first thing to check for anything unusual.

What makes a simple signature hold up

Since the weakness of a drawn signature is evidential, the fix is evidential too. What actually decides a dispute is rarely the image on the page; it is everything around it:

• The transmission record. Emails showing the document being sent to an address controlled by the signatory and returned signed, with headers and timestamps intact.
• Identification. Anything tying the act to the person — an authenticated account, a code sent to their phone, a copy of an ID exchanged alongside.
• Integrity. A way to show the signed document is the one that was agreed. A hash of the final PDF recorded in the covering email is crude but effective, and costs nothing.
• Subsequent conduct. Invoices paid, work started, the terms relied on. Courts give this real weight, because people do not usually perform contracts they never made.
• The absence of a denial. Most signatures are never contested. The genuine risk is concentrated in high-value or adversarial situations, which is where the extra rigour belongs.

Choosing the right level

A practical mapping, erring toward caution:

• Drawn signature is fine: internal approvals, delivery notes, school and club forms, NDAs between parties who trust each other, low-value orders, returning a form that only needs to show you read it.
• Prefer an advanced signature: commercial contracts of real value, employment documents, anything with a counterparty you do not know well, anything you would be uncomfortable defending in two years from memory alone.
• Qualified is required or strongly advisable: where a national law imposes it. Depending on the country this can cover certain real-estate deeds, some public procurement, particular HR formalities and filings with certain authorities. When a specific statute names a form requirement, nothing below it will do — check the rule for the document at hand.

A last practical note: a signature is not the same thing as an integrity seal. If your concern is that nobody alters the document after you send it, the answer is a certificate-based signature, not a nicer-looking image. And if you only need the recipient to see that the copy is a copy, a watermark or a stamp does that job more honestly than a signature does.

This is general information about how these rules work, not legal advice. For a specific document in a specific country, ask a qualified professional.

Frequently asked questions

Is a scanned image of my handwritten signature legally valid?

It is a simple electronic signature and is admissible in the EU and the US alike. Its weakness is that it is trivially copyable and proves nothing about the document, so its evidential weight depends on the record surrounding it.

Can someone reuse my signature image from a PDF I sent them?

Yes — the image can be extracted from the file and placed on another document. This is inherent to image signatures and is the main practical argument for certificate-based signing on anything sensitive. It is also a reason to avoid publishing signed documents openly.

Does adding a date next to the signature help?

A typed date is a statement, not proof, since it can be typed as anything. What carries weight is an independent timestamp: the email that transmitted the file, or a qualified timestamp from a trust service provider embedded in a cryptographic signature.

Do both parties need to sign the same way?

Generally no — a contract can be signed by different means by each party, and counterparts are widely accepted. If a statute imposes a particular form, though, it usually imposes it on the act, so all signatures must meet it.

Does flattening a signature into the page make it stronger?

It makes it harder to move accidentally, and it means the recipient cannot drag it off in a normal reader. It adds nothing cryptographic: the file can still be modified without detection. It is tidiness, not security.

Further reading

• Sign a PDF in your browser
• What is actually inside a PDF file
• What PDF metadata reveals about you