The signature’s ByteRange array names the bytes the digest covers: “An array of pairs of integers (starting byte offset, length in bytes) that shall describe the exact byte range for the digest calculation.” Every byte is in it except the gap for the signature value, which for the common adbe.pkcs7.detached kind also holds the signer’s certificates: “the certificate chain shall be put in the PKCS#7 envelope in Contents.” The check is the digest: “Differences in the digest values indicate that modifications have been made since the document was signed.”

So a change to any signed byte makes verification fail. A change appended after the signed bytes, as an incremental update, leaves the signature valid for the version that was signed; the standard puts it as “the data corresponding to the byte range of the original signature is preserved.”

What does a signature’s byte range look like?

PDF Textfix’s demo signed note has one signature, read here with qpdf, which prints the object on one line (reflowed here, the zeros shortened):

$ qpdf --show-object=18 "Demo Signed.pdf"
<< /ByteRange [ 0 44956 47006 564 ] /Contents <000…000> /Filter /Adobe.PPKLite
   /Location (Port Elm) /M (D:20260914103000Z) /Name (Priya Raman)
   /Reason (I accept the delivered work) /SubFilter /adbe.pkcs7.detached /Type /Sig >>

The first range is bytes 0 to 44,955; the second runs 564 bytes from byte 47,006 to the end of the 47,570-byte file. The 2,050 bytes between them are the Contents string, where the signature value belongs. Here it is a placeholder, 2,048 zeros with no signature and no certificate, so a viewer that checks signatures reports it as not valid. Poppler’s pdfsig agrees on the ranges (shortened to the lines about them):

Signature #1:
  - Signature Field Name: Signature1
  - Signature Type: adbe.pkcs7.detached
  - Signed Ranges: [0 - 44956], [47006 - 47570]

What is the difference between a digital and an electronic signature?

An electronic signature is the broad idea. US federal law defines it as “an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record”. A typed name, a click or a picture of handwriting can fit that definition. In Preview, “To sign PDFs, you can capture your signature using your trackpad, the built-in camera on your Mac, or your iPhone or iPad.” That places your name’s shape on the page; it covers no bytes and records nothing about later changes.

A digital signature is the cryptographic kind: it may show a name or nothing at all, and its proof is the digest over the signed bytes.

How do you check whether a PDF signature is valid?

In Acrobat, open the Signatures panel, choose Options, then Validate Signatures. Adobe describes what that checks: “You can validate a signature in a signed document to verify the authenticity of the signer and the signed content.” The signer half is about trust: “To verify authenticity, you can check if the signer’s certificate or its parent certificates are trusted.”

What does an edit do to a signed PDF?

PDF Textfix treats a file whose signature field holds a byte range as signed. The banner reads “This file is signed: saving an edit rewrites it, so its signatures will no longer verify. You will be asked to confirm before the first edit.” When you apply the first edit, a sheet titled “Edit a signed document?” shows the line before and after. Save writes the whole file again, without earlier revisions, so the signature stays but no longer matches.

What should you do if a signed PDF needs a correction?

Keep the signed original, edit a copy (File > Save As, ⇧⌘S), and ask the signer to sign the corrected file. How to edit a signed PDF has the steps; Can you tell if a PDF has been edited? covers the traces an edit leaves.

Questions about PDF signatures

Does a digital signature stop anyone from editing the file?

No. It detects changes; it does not block them.

Why does a PDF signature show as not valid?

Either the signed bytes changed, or the viewer cannot trust the signer’s certificate. The demo note’s fails because its signature value is a placeholder: there is no signature and no certificate to check.

Can a signed PDF be signed again after an edit?

Yes, with a new signature over the new bytes, made by the signer.