How to sign a PDF online without printing it

The ritual is muscle memory: print, hunt for a working pen, sign in the margin, photograph it in a hallway, email the JPEG. The other side says it is blurry. You do it again. None of this makes the contract more binding. It makes it slow, and it produces three files where you needed one.

The PDF is already the document. Taking it out of the machine and back in is theatre we inherited from a time when 'signature' meant ink because there was nothing else. If both sides can read the text, confirm they accept it, and you can show who did what, you have what most leases, freelance jobs and NDAs actually need.

The office printer is not a legal instrument. It is a habit. Habits get expensive when they cost an afternoon and a pissed-off counterparty in Berlin who only wanted the file back before lunch.

In the EU and Norway (via the EEA), eIDAS splits signatures into three levels. SES is the simple one: you show intent, usually by drawing, typing a name, or clicking accept after seeing the document. AES is advanced: stronger binding to identity and to the data. QES is qualified: issued by a trusted provider, often via BankID or similar in Norway, and treated like handwritten signature where the law requires that.

Most commercial deals between adults do not require QES. Norwegian contract law is generally form-free. You can bind yourself by email, by a checkbox, by a scrawl. A signing tool does not invent extra law. It makes the yes visible, timestamped, and hard to pretend never happened.

A PNG of your squiggle is SES at its thinnest. Better: an email link, a field you actually have to hit, a log with time and IP, and — if you want integrity inside the file — a cryptographic PAdES stamp. That is still not BankID. It is honest SES plus maths that flags tampering.

Drawing with a finger or a mouse looks like a 'real' signature. It is theatre. Legally it is the same kind of yes as typing your name. Pick what the other person expects to see, not what you imagine a judge will admire. A judge looks at whether you had reason to understand what you accepted.

Uploading a scan of your 2011 signature is popular and weak. That image can live in five other PDFs. It does not prove you were there on Tuesday. If you are going digital, let the tool log the act instead of pasting in a relic.

Type the name clearly if a human who does not know your squiggle has to read it. Draw if ceremony matters to the client. Click-to-accept is the most honest: nobody pretends it is ink. All of these are SES unless you step up to a qualified eID.

No, no, and usually no. They need a link and a browser. Forcing a signup is how documents die in inboxes. People bounce. You call. They say they 'couldn't log in'.

BankID is a high-assurance identity proof. Use it when the law or your risk appetite says you must know, with high confidence, that it is Kari and not someone with Kari's email. For a deal to ship a website in April, email plus a visible document plus a log is what people actually use — including people who use BankID for everything else.

Adobe Reader is not a party to the contract. If you send a finished signed PDF, they open it in whatever they have. If the certificate is not on Adobe's list, they get a warning. Explain that up front or they will think the file is broken. The warning means 'unknown issuer', not 'this does not count'.

A scanned signature on page three does not stop anyone replacing page two. The picture sits where it sits. That is why cryptographic PDF signatures (PAdES) exist: a hash of the content, signed with a key, so changes show up.

Plenty of tools give you SES without touching PDF crypto. Then the proof lives in the vendor's log — fine if you trust the log and can download an evidence pack. Stronger: the PDF itself carries a PAdES stamp. Open it later and you can see whether the bytes still match. Note: a stamp from an unknown CA will not go green in Acrobat. Integrity can still be checked against the issuer's fingerprint.

Sign This, Dammit! does the latter honestly: SES against the person, PAdES against the file, not QES, not BankID, free because the wall has ads. If you need qualified level, that is a different product.

When a specific statute demands writing, witnesses, a notary, or a qualified electronic signature. Real property, some family-law papers, certain public filings — you do not win those by being quick in Chrome. Check the source, not a vendor blog.

When the other side is an agency or a bank that has locked itself to its own flow, you follow their flow. You will not talk the tax authority into accepting a doodle in a random PDF.

When you deliberately want high identity assurance — large sums, a stranger, a dispute you can already smell — BankID or another eID is sensible. Not because SES is 'invalid', but because you want to sleep. The rest of the week: upload, send the link, stop feeding the printer.