← All posts

Why flattening broke my PDF’s digital signature

You flattened a PDF — to stop someone re-typing the form fields, or to press the comments into the page before it went out — and now the signature at the bottom has a red cross on it. Acrobat says the document has been altered or corrupted since it was signed.

Nothing you did looks like altering it. The pages are identical. The name in the signature block is still there, in the same place, in the same handwriting.

It does not matter. The signature was never a promise about how the document looks. It was a promise about its bytes, and flattening rewrote every one of them.

Two different things get called a signature

Before anything else, work out which one you have, because only one of them can break.

A drawn signature is a picture of a name. Someone scribbled with a mouse, or pasted a scan of their biro, and it sits on the page as an image, as ink drawn into the content, or as an annotation floating on top. It carries no proof of anything. Anybody with an editor can move it, copy it onto another document, or delete it — our Remove annotations from PDF tool strips the annotation kind in one click, which tells you roughly what it is worth as evidence. (On a completed form, reach for that tool carefully: removing the fields removes the answers.) Flattening does nothing bad to a drawn signature. It makes it more permanent, which is usually why you flattened.

A digital signature is a certificate-based seal. Someone signed with a credential — a national ID card, a corporate certificate, a Docusign or Adobe account — and a reader shows it in a signature panel with a validity status, a signer name and a signing time. This is the one that just broke, and it broke for a precise reason.

If you are not sure which you have, open the file and click the signature. A drawn one does nothing. A digital one opens a properties dialogue.

What a digital signature actually covers

Here is the mechanism, and it is the part every page ranking for this question leaves out.

When a document is signed, the signer's software writes a signature dictionary into the file. Two entries in it matter. /Contents holds the cryptographic blob. /ByteRange holds four numbers, and those four numbers are the whole story: offset 0, this many bytes, then start again at that offset, and this many bytes to the end. Two spans, with a gap between them. The gap is the hole where /Contents itself sits, because a signature cannot include itself in what it signs.

Everything outside that hole — the entire rest of the file, every object, the cross-reference table, the trailer — is hashed, and that hash is what got signed.

So the promise is not "this document says what it said". It is "these exact bytes, at these exact offsets, are the bytes I signed". Change one of them and the hash changes. Move one of them and the byte ranges no longer describe the same thing. The reader recomputes the hash, gets a different number, and tells you the document has been altered. It cannot tell you how it was altered, and it would say the same thing if you had changed a figure in the contract.

Why flattening is guaranteed to break it

Flattening is not an edit to a page. It is a rebuild of the document.

Every form field and annotation is an object with an appearance stream that the reader draws on top of the page. Flattening takes that appearance, writes it into the page's own content stream, and deletes the object. The page content stream is now longer. Every object after it in the file has moved. The cross-reference table that says where each object lives is rebuilt from scratch, and the file is written out fresh from the first byte to the last.

There is no version of that which leaves the signed bytes where they were. Even flattening nothing would do it: save a PDF through almost any library and the offsets shift.

There is a second, worse thing that happens. A digital signature lives in a signature field, and a signature field is a form field. Flatten the form and that field goes the way of the others — its visible appearance is pressed into the page and the object is deleted. What comes back is not a document with a broken signature. It is a document with a picture of a signature and nothing behind it, and no signature panel at all. A broken signature announces itself. A flattened one looks fine and proves nothing, which is why you should open the result and check rather than trusting the thumbnail.

It is not our tool, and it is not a bug

Acrobat does the same. So does every other flattening tool, every merger, and every command line. Merging a signed PDF into a bundle kills the signature for the identical reason: the result is a new file. So does encrypting one afterwards — if you need a password on a signed document, set it before signing, not after.

You may have seen a signed PDF change without breaking, and that is worth explaining, because it is the exception that proves the rule. The PDF format allows an incremental update: instead of rewriting the file, a reader appends new objects to the end and leaves every existing byte untouched. The signed byte range still hashes correctly, so the signature survives. That is how a second person countersigns, and how you can fill in a form that was certified with form-filling allowed.

But the signer decides at signing time what later changes are permitted — no changes at all, form filling and signing, or form filling, signing and annotation. Flattening is in none of those categories, and it cannot be done by appending anyway, because it has to change page content that already exists. So there is no tool, anywhere, that flattens a signed PDF and keeps the signature valid. If one claims to, it is re-signing the result with its own certificate, which is a different promise from a different signer.

Get the order right instead

The fix is sequencing, and it is easy once you stop looking for a workaround. Signing goes last.

  1. Fill the form in and save it, in the reader, so the values are actually written to the file rather than only displayed.
  2. Flatten it with Flatten PDF. Form fields on; tick comments too if the mark-up is part of the record. Check the notes it gives you and open the result: the answers should look identical and no longer respond to a click.
  3. Do everything else now — the watermark, the metadata, the page numbers, the password with Password protect PDF. Every one of these rewrites the file, so every one of them has to happen before the signature exists.
  4. Then sign it, in whatever your signing process is.

A document flattened before signing is the strongest version of what most people are actually after: the answers are permanent page content, and the seal covers them. And plenty of people who arrive here were never trying to sign anything — they wanted a completed form nobody downstream could quietly alter, which flattening does perfectly well on its own.

If it is already signed and it has to be flattened anyway

Then you have a decision, not a technical problem. Your options are all versions of accepting the loss:

What does not work is flattening the signed file in place and hoping. That destroys the only copy of the evidence, permanently, to solve a problem that a re-signature would have solved in a morning.

Checking what you have, before and after

Our PDF inspector runs in the browser without uploading anything and reads out the form field count and which software produced the file — useful for working out whether something has already rewritten it. It does not report signatures, so for that you want one of these, and both are free:

For producing signatures without buying anything, LibreOffice can apply a certificate-based signature in the Digital Signatures tab of its PDF export dialogue, which fits the sequencing above neatly: build the document, flatten it, export and sign in one step.

A digital signature is a promise about bytes. Flattening changes bytes. Neither feature is broken; they simply cannot happen in that order.

Tools this post uses: