Can a Signed PDF Be Redacted or Edited? What Breaks and Why

A signed PDF can be redacted or edited, but never without consequences. If the tool rewrites the file, the signature becomes invalid. If it appends the change instead, the signature may still verify, yet the file now records changes made after signing and the original, unredacted content stays inside the file. The safe route is to redact a copy.

This question comes up constantly in regulated work: a signed clinical study report needs patient identifiers removed before disclosure, an inspector asks for a signed batch record with commercial terms blacked out, or a data subject access request covers a signed letter. This article explains what a PDF signature actually protects, the two ways a file can be changed, and a workflow that keeps the record intact.

What a digital signature locks

A certificate-based digital signature in a PDF works on bytes, not on what the page looks like. ISO 32000-1, the PDF 1.7 standard, says in section 12.8.1 that a signature is created by computing a digest of the document's data and storing it in the document; to verify, the digest is recomputed and compared, and differences in the digest values indicate that modifications have been made since the document was signed.

The bytes covered are recorded in the signature's ByteRange entry. The standard recommends that the range should be the entire file except the signature value itself, and the European PAdES baseline profile (ETSI EN 319 142-1) requires it. So the signature covers every page, every font and every hidden object, not just the visible text.

A drawn or pasted signature image is different: it is just part of the page and protects nothing. If that is what your document has, see our explainer on electronic and digital signatures.

Two ways a PDF gets changed

What happens to a signature depends on how the editing software saves the file.

• A full rewrite. The program writes a completely new file. Byte positions shift, so the digest no longer matches and the signature fails validation.
• An incremental update. ISO 32000-1 section 7.5.6 allows changes to be appended to the end of the file, leaving its original contents intact. The signed bytes are untouched, so the signature over them can still verify.

An incremental update sounds like the answer, but read the note in section 12.8.1 carefully: if a signed document is modified and saved by incremental update, the data covered by the original signature is preserved, so it is possible to recreate the state of the document as it existed at the time of signing. That is exactly what you want for an approval record. It is exactly what you do not want for a redaction.

Why an appended redaction is not a redaction

Suppose you open a signed report, apply redactions and save, and your software saves incrementally to keep the signature valid. The new revision shows black boxes. The earlier, signed revision, with the names and numbers you meant to remove, is still in the file, complete. Anyone who extracts that earlier revision can read it; the standard itself says the signed state can be recreated.

The PDF standard is clear that redaction means removing content. Section 12.5.6.23 describes redaction annotations as a two-step process: first content is marked, then the user applies the redactions, after which the content in the marked area is removed. Removing content from a signed revision is precisely the change a signature exists to detect, so there is no way to redact a signed revision and keep that signature meaning what it meant.

What edits a signature allows

A document can carry a certification signature that says which later changes are acceptable. ISO 32000-1 Table 254 defines three permission levels for the DocMDP transform:

• 1: no changes are permitted; any change invalidates the signature.
• 2 (the default): filling in forms, instantiating page templates and signing are permitted.
• 3: as level 2, plus creating, deleting and modifying annotations.

Even at the most permissive level, the allowed changes are additions such as form entries, further signatures and comments. Removing or altering page content is not on the list. A comment saying "redacted" placed over a name is an annotation, which level 3 allows, and it hides nothing: the name is still in the signed content underneath.

A workflow that keeps the record and protects the data

1. Keep the signed original unchanged. Store it under access control in your document management system. It remains the record.
2. Make a working copy. Give it a name that marks it as a redacted copy, so nobody mistakes it for the record.
3. Redact the copy by removing content. Use a tool that deletes the text and images in the marked areas and writes a new file. The copy's original signature will now fail, which is expected.
4. Test the redaction. Search the copy for each redacted word, copy and paste around each box into a plain text editor, and check document properties, attachments and comments. Our guide on redacting a PDF properly covers the checks.
5. Remove hidden data. Metadata, attachments and form data can repeat what you removed from the page. Removing metadata is part of the job.
6. Sign the copy afresh if the recipient needs a signature. The new signature is made by the person releasing the copy and attests to the redacted version, not to the original approval. Record who redacted, what and why, as your procedure requires.

What our tools do with signed files

Find and Redact and Rasterize PDF both write a complete new file rather than an incremental update, so any existing digital signature in their output will no longer validate. Plan for that before you start.

Find and Redact searches the text for every instance of the terms you enter and lets you choose which matches to cover. At the time of writing it draws opaque boxes over the selected matches and does not delete the text underneath, so on its own it is a visual cover, not a removal. To remove the text layer, run the result through Rasterize PDF with PDF output: it renders each page, boxes included, to a JPEG image and builds a new PDF from those images, so the original text, links and form fields no longer exist as live content. The cost is that the copy is no longer searchable. Run the search and copy tests afterwards either way.

If the redacted copy must be signed, Digital Sign PDF can sign it in your browser with a certificate file you provide (a .pfx, .p12 or PEM file). It creates a signature with the adbe.pkcs7.detached format and no timestamp. ETSI EN 319 142-1 clause 6.3 requires the ETSI.CAdES.detached format for PAdES baseline signatures, so ours is not one; if your organisation requires PAdES, or a qualified signature under eIDAS, use your approved signing service.

How to check a signature after any change

Open the file in a full PDF reader such as Adobe Acrobat Reader and check its signature panel. For testing, the European Commission's DSS demonstration validator also checks signed files, but it sends files to Commission infrastructure, is for testing only, and its page advises against using documents with sensitive material.

Based on how signatures and incremental updates work in ISO 32000-1, three outcomes are possible: the signature is valid and nothing changed; it is valid for its revision but later changes were appended; or it is invalid because the signed bytes changed. Only the first means the document is as signed.

Quick answers for common situations

This article is general information about the PDF format and signature standards, not legal advice. For disclosures involving personal data or regulated records, follow your organisation's procedures and check with your DPO, QA or legal team.